在nginx跨域請(qǐng)求cors配置如下：

location / {
        add_header         'Access-Control-Allow-Origin' 'https://api.xxxx.com';
        add_header         "Access-Control-Allow-Credentials" "true";
        add_header         "Access-Control-Allow-Headers" "x-requested-with,content-type";
        proxy_pass         http://localhost:8080;
        proxy_set_header   Host             $host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
}

主要是添加了三個(gè)用于控制CORS的頭信息：

• Access-Control-Allow-Origin：允許的來源
• Access-Control-Allow-Credentials：設(shè)置為true，允許ajax異步請(qǐng)求帶cookie信息
• Access-Control-Allow-Headers：設(shè)置為x-requested-with,content-type，允許ajax余部請(qǐng)求。

這個(gè)配置也可以在spring mvc里配置。

問題：

配置好后，異步跨域請(qǐng)求成功。

當(dāng)發(fā)起post請(qǐng)求，請(qǐng)求的數(shù)據(jù)是放在request body里，請(qǐng)求的Content-Type為application/json。Spring MVC需要使用@RequestBody來接收數(shù)據(jù)。

這是一次非簡(jiǎn)單的請(qǐng)求，瀏覽器會(huì)發(fā)起一次Options的預(yù)請(qǐng)求。發(fā)起Options請(qǐng)求報(bào)403錯(cuò)誤：

Failed to load https://api.xxxx.com/auth.json: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://other.xxxx.com' is therefore not allowed access. The response had HTTP status code 403.

?

解決方法

原以為是自己的配置有誤，但找了很多資料可以確定配置是沒有問題。后來debug跟蹤Spring MVC DispatcherServlet的調(diào)用，發(fā)現(xiàn)在DispacerServlet是因?yàn)闆]有找都到執(zhí)行Options請(qǐng)求的方法。

在做跨域請(qǐng)求時(shí)，配置好CORS相關(guān)頭信息后，以為就可以了，這很容易忽略在Spring MVC添加對(duì)Options請(qǐng)求的處理。

解決方法有兩種：

• 在攔截器統(tǒng)一添加對(duì)Options請(qǐng)求的支持
• 添加一個(gè)支持Options的ReqeuestMapping。

攔截器示例：

public class CrosDomainAllowInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
                             Object handler) throws Exception {
        if(request.getMethod().equals(RequestMethod.OPTIONS.name())) {
            response.setStatus(HttpStatus.OK.value());
            return false;
        }
        return true;
    }
    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response,
                           Object handler, ModelAndView modelAndView) throws Exception {
    }
    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response,
                                Object handler, Exception ex) throws Exception {
    }
}

@RequestMapping示例

@RequestMapping(value = "/*",method = RequestMethod.OPTIONS)
public ResponseEntity handleOptions(){
    return ResponseEntity.noContent();
}