Spring Security使用中Preflight请求和跨域问题详解

@Component
public class CorsFilter implements Filter {

 Logger logger= LoggerFactory.getLogger(CorsFilter.class);

 @Override
 public void init(FilterConfig filterConfig) throws ServletException {

 }

 @Override
 public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
  HttpServletRequest request= (HttpServletRequest) servletRequest;
  HttpServletResponse response= (HttpServletResponse) servletResponse;
  response.setHeader("Access-Control-Allow-Origin",request.getHeader("origin"));
  response.setHeader("Access-Control-Allow-Origin","*"); //允许跨域访问的域
  response.setHeader("Access-Control-Allow-Methods","POST,GET,OPTIONS,DELETE,PUT"); //允许使用的请求方法
  response.setHeader("Access-Control-Expose-Headers","*");
  response.setHeader("Access-Control-Allow-Headers", "x-requested-with,Cache-Control,Pragma,Content-Type,Authorization"); //允许使用的请求方法
  response.setHeader("Access-Control-Allow-Credentials","true");//是否允许请求带有验证信息
  filterChain.doFilter(servletRequest, servletResponse);
 }

 @Override
 public void destroy() {

 }
}

 @Override
 protected void configure(HttpSecurity http) throws Exception {
  http
    // 由于使用的是JWT，我们这里不需要csrf
    .csrf().disable()
    // 基于token，所以不需要session
    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
    .authorizeRequests()
    // 所有 / 的所有请求 都放行
    .requestMatchers(CorsUtils::isPreFlightRequest).permitAll() //对preflight放行
    .antMatchers("/*").permitAll()
    .antMatchers("/u").denyAll()
    .antMatchers("/article/**").permitAll()
    .antMatchers("/video/**").permitAll()
    .antMatchers("/api/**").permitAll()
    .antMatchers("/v2/api-docs", "/configuration/ui", "/swagger-resources/**", "/configuration/**","/swagger-ui.html", "/webjars/**")
    .permitAll()
    .antMatchers("/manage/**").hasRole("ADMIN") // 需要相应的角色才能访问
    // 除上面外的所有请求全部需要鉴权认证
    .anyRequest().authenticated();

  // 禁用缓存
  http.headers().cacheControl();
  // 添加JWT filter
  http.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
  //添加未授权处理
  http.exceptionHandling().authenticationEntryPoint(getAuthenticationEntryPoint());
  //权限不足处理
  http.exceptionHandling().accessDeniedHandler(getAccessDeniedHandler());

 }