Spring的@CrossOrigin注解处理请求源码解析

/**
 * 获取CorsConfiguration.
 */
@Override
protected CorsConfiguration getCorsConfiguration(Object handler, HttpServletRequest request) {
    // 若处理器为CorsConfigurationSource类型，直接获取处理器CorsConfiguration配置.
    CorsConfiguration corsConfig = super.getCorsConfiguration(handler, request);
    if (handler instanceof HandlerMethod) {
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        // 请求方法是预处理方法.
        if (handlerMethod.equals(PREFLIGHT_AMBIGUOUS_MATCH)) {
            return AbstractHandlerMethodMapping.ALLOW_CORS_CONFIG;
        }
        // 请求方法非预处理方法.
        else {
            // 根据处理器查找CorsConfiguration配置.
            CorsConfiguration corsConfigFromMethod = this.mappingRegistry.getCorsConfiguration(handlerMethod);
            // 合并corsConfig和corsConfigFromMethod.
            corsConfig = (corsConfig != null ? corsConfig.combine(corsConfigFromMethod) : corsConfigFromMethod);
        }
    }
    return corsConfig;
}

/**
 * 检索给定处理程序的CORS配置.
 * @param handler 处理器.
 * @param request 当前请求.
 * @return 处理程序的CORS配置，或者null（如果没有）.
 */
@Nullable
protected CorsConfiguration getCorsConfiguration(Object handler, HttpServletRequest request) {
    Object resolvedHandler = handler;
    if (handler instanceof HandlerExecutionChain) {
        resolvedHandler = ((HandlerExecutionChain) handler).getHandler();
    }
    if (resolvedHandler instanceof CorsConfigurationSource) {
        return ((CorsConfigurationSource) resolvedHandler).getCorsConfiguration(request);
    }
    return null;
}

/**
 * 返回CORS配置.
 * 线程安全并发使用.
 */
public CorsConfiguration getCorsConfiguration(HandlerMethod handlerMethod) {
    // 解析实际的HandlerMethod.
    HandlerMethod original = handlerMethod.getResolvedFromHandlerMethod();
    // 从corsLookup中获取CorsConfiguration配置.
    return this.corsLookup.get(original != null ? original : handlerMethod);
}

/**
 * 为CORS相关处理更新HandlerExecutionChain.
 * 对于预处理请求，默认实现用一个简单的HttpRequestHandler替换所选的处理程序，
 * 	该处理程序调用配置的setCorsProcessor.
 * 对于实际的请求，默认实现插入一个HandlerInterceptor，它进行CORS相关的检查并添加CORS头.
 * @param request 当前请求.
 * @param chain 处理链.
 * @param config 适用的CORS配置（可能是null）.
 */
protected HandlerExecutionChain getCorsHandlerExecutionChain(HttpServletRequest request,
                                                             HandlerExecutionChain chain, @Nullable CorsConfiguration config) {
    // 是CORS预处理请求.
    if (CorsUtils.isPreFlightRequest(request)) {
        HandlerInterceptor[] interceptors = chain.getInterceptors();
        chain = new HandlerExecutionChain(new PreFlightHandler(config), interceptors);
    }
    // 不是CORS预处理请求.		
    else {
        chain.addInterceptor(new CorsInterceptor(config));
    }
    return chain;
}

/**
 * 处理请求.
 */
@Override
@SuppressWarnings("resource")
public boolean processRequest(@Nullable CorsConfiguration config, HttpServletRequest request,
                              HttpServletResponse response) throws IOException {
    // 非CORS请求，不进行处理.
    if (!CorsUtils.isCorsRequest(request)) {
        return true;
    }
    // 响应已包含Access-Control-Allow-Origin，不进行处理.
    ServletServerHttpResponse serverResponse = new ServletServerHttpResponse(response);
    if (responseHasCors(serverResponse)) {
        logger.debug("Skip CORS processing: response already contains \"Access-Control-Allow-Origin\" header");
        return true;
    }
    // 请求来自同源，不进行处理.
    ServletServerHttpRequest serverRequest = new ServletServerHttpRequest(request);
    if (WebUtils.isSameOrigin(serverRequest)) {
        logger.debug("Skip CORS processing: request is from same origin");
        return true;
    }
    // 是否预处理请求.
    boolean preFlightRequest = CorsUtils.isPreFlightRequest(request);
    if (config == null) {
        if (preFlightRequest) {
            rejectRequest(serverResponse);
            return false;
        }
        else {
            return true;
        }
    }
	// 请求处理方法.
    return handleInternal(serverRequest, serverResponse, config, preFlightRequest);
}

/**
 * 请求处理方法.
 */
protected boolean handleInternal(ServerHttpRequest request, ServerHttpResponse response,
                                 CorsConfiguration config, boolean preFlightRequest) throws IOException {
    // 获取请求的Origin头.
    String requestOrigin = request.getHeaders().getOrigin();
    // 检查并获取允许源.
    String allowOrigin = checkOrigin(config, requestOrigin);
    HttpHeaders responseHeaders = response.getHeaders();
    // 增加Vary头，其值为：Origin、Access-Control-Request-Method、Access-Control-Request-Headers.
    responseHeaders.addAll(HttpHeaders.VARY, Arrays.asList(HttpHeaders.ORIGIN,
                                                           HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, HttpHeaders.ACCESS_CONTROL_REQUEST_HEADERS));
    // 允许源为空，则拒绝请求.
    if (allowOrigin == null) {
        logger.debug("Rejecting CORS request because '" + requestOrigin + "' origin is not allowed");
        rejectRequest(response);
        return false;
    }
    // 获取请求方法.
    HttpMethod requestMethod = getMethodToUse(request, preFlightRequest);
    // 检查并获取允许的方法.
    List<HttpMethod> allowMethods = checkMethods(config, requestMethod);
    // 允许方法为空，则拒绝请求.
    if (allowMethods == null) {
        logger.debug("Rejecting CORS request because '" + requestMethod + "' request method is not allowed");
        rejectRequest(response);
        return false;
    }
    // 获取请求头.
    List<String> requestHeaders = getHeadersToUse(request, preFlightRequest);
    // 检查并获取请求的头.
    List<String> allowHeaders = checkHeaders(config, requestHeaders);
    // 预处理请求，且允许的头为空，拒绝请求.
    if (preFlightRequest && allowHeaders == null) {
        logger.debug("Rejecting CORS request because '" + requestHeaders + "' request headers are not allowed");
        rejectRequest(response);
        return false;
    }
    // 设置允许的源.
    responseHeaders.setAccessControlAllowOrigin(allowOrigin);
    // 设置Access-Control-Allow-Methods.
    if (preFlightRequest) {
        responseHeaders.setAccessControlAllowMethods(allowMethods);
    }
    // 设置Access-Control-Allow-Headers.
    if (preFlightRequest && !allowHeaders.isEmpty()) {
        responseHeaders.setAccessControlAllowHeaders(allowHeaders);
    }
    // 设置Access-Control-Expose-Headers.
    if (!CollectionUtils.isEmpty(config.getExposedHeaders())) {
        responseHeaders.setAccessControlExposeHeaders(config.getExposedHeaders());
    }
    // 设置Access-Control-Allow-Credentials.
    if (Boolean.TRUE.equals(config.getAllowCredentials())) {
        responseHeaders.setAccessControlAllowCredentials(true);
    }
    // 设置Access-Control-Max-Age.
    if (preFlightRequest && config.getMaxAge() != null) {
        responseHeaders.setAccessControlMaxAge(config.getMaxAge());
    }
    response.flush();
    return true;
}