Java跨域问题的几种后端解决方式举例详解

@Configuration
public class CorsConfig implements WebMvcConfigurer {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")// 拦截所有的请求
            .allowedOrigins("*")// 可跨域的域名，*为所有
            .allowCredentials(true)
            .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")// 允许跨域的方法，可以单独配置
            .maxAge(3600);
    }
}

@Component
public class CorsInterceptor implements HandlerInterceptor {
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        response.setHeader("Access-Control-Allow-Origin", "http://example.com");
        response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
        response.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
        response.setHeader("Access-Control-Allow-Credentials", "true");
        return true;
    }
    // ...
}
```

这将允许来自 http://example.com 的跨域请求访问应用程序中的 API。

@WebFilter
public class CorsFilter implements Filter {
    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) res;
        response.setHeader("Access-Control-Allow-Origin", "http://example.com");
        response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
        response.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
        response.setHeader("Access-Control-Allow-Credentials", "true");
        chain.doFilter(req, res);
    }
    // ...
}
````

这将允许来自 http://example.com 的跨域请求访问应用程序中的 API。

@CrossOrigin(origins = "http://example.com")
@RestController
public class MyController {
    // ...
}
```
这将允许来自 http://example.com 的跨域请求访问 MyController 中的方法。

@CrossOrigin(origins = {"http://example1.com", "http://example2.com"})
@RestController
public class MyController {
    // ...
}
```

@CrossOrigin(origins = "http://example.com", methods = {RequestMethod.GET, RequestMethod.POST})
@RestController
public class MyController {
    // ...
}
```

@CrossOrigin(origins = "http://example.com", allowedHeaders = {"Content-Type", "Authorization"})
@RestController
public class MyController {
    // ...
}
```

@CrossOrigin(origins = "http://example.com", allowCredentials = "true")
@RestController
public class MyController {
    // ...
}
```

response.setHeader("Access-Control-Allow-Origin", "http://example.com");
```
如果希望允许所有域名访问 API，可以将值设置为 *：

response.setHeader("Access-Control-Allow-Origin", "http://example1.com, http://example2.com");
```

response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
```

response.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
```

response.setHeader("Access-Control-Allow-Credentials", "true");
```
最后，需要将这些响应头添加到每个需要跨域访问的 API 的响应中。

location / {
   add_header Access-Control-Allow-Origin *;
   add_header Access-Control-Allow-Headers X-Requested-With;
   add_header Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS;

   if ($request_method = 'OPTIONS') {
     return 204;
   }
}

add_header 'Access-Control-Allow-Credentials' 'true';

- id: my_route
  uri: http://localhost:8080
  predicates:
    - Path=/api/**
  filters:
    - RewritePath=/api/(?<segment>.*), /$\{segment}
    - AddResponseHeader=Access-Control-Allow-Origin:http://example.com
    - AddResponseHeader=Access-Control-Allow-Methods:GET, POST, PUT, DELETE
    - AddResponseHeader=Access-Control-Allow-Headers:Content-Type, Authorization
    - AddResponseHeader=Access-Control-Allow-Credentials:true
`````

这将允许来自 http://example.com 的跨域请求访问 Gateway 中的 API。

- AddResponseHeader=Access-Control-Allow-Credentials:true
`````
最后，需要将这些配置添加到每个需要跨域访问的 API 的路由配置中。
需要注意的是，如果在 Gateway 的路由中使用了负载均衡，需要在负载均衡的路由配置中添加以上配置。如果使用了反向代理，也需要在反向代理的路由配置中添加以上配置。