SpringBoot中处理跨域请求CORS的全面指南

@Configuration
public class CorsConfig implements WebMvcConfigurer {
    
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")  // 所有接口
                .allowedOrigins("*")  // 允许所有源
                .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")  // 允许方法
                .allowedHeaders("*")  // 允许所有头
                .allowCredentials(true)  // 允许凭证
                .maxAge(3600);  // 预检请求缓存时间
    }
}

@Bean
public CorsFilter corsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    CorsConfiguration config = new CorsConfiguration();
    
    config.setAllowCredentials(true);
    config.addAllowedOrigin("*");
    config.addAllowedHeader("*");
    config.addAllowedMethod("*");
    source.registerCorsConfiguration("/**", config);
    
    return new CorsFilter(source);
}

@RestController
@RequestMapping("/api")
public class UserController {
    
    // 单个方法配置
    @CrossOrigin(origins = "http://localhost:3000")
    @GetMapping("/users")
    public List<User> getUsers() {
        // ...
    }
    
    // 整个控制器配置
    @CrossOrigin(origins = "*", maxAge = 3600)
    @RestController
    @RequestMapping("/products")
    public class ProductController {
        // ...
    }
}

spring:
  mvc:
    cors:
      allowed-origins: "http://localhost:3000, https://example.com"
      allowed-methods: "GET, POST, PUT, DELETE"
      allowed-headers: "*"
      exposed-headers: "Authorization, Content-Disposition"
      allow-credentials: true
      max-age: 1800

spring.mvc.cors.allowed-origins=http://localhost:3000, https://example.com
spring.mvc.cors.allowed-methods=GET, POST, PUT, DELETE
spring.mvc.cors.allowed-headers=*
spring.mvc.cors.exposed-headers=Authorization, Content-Disposition
spring.mvc.cors.allow-credentials=true
spring.mvc.cors.max-age=1800

@RestController
public class ApiController {
    
    @GetMapping("/manual")
    public ResponseEntity<String> manualCors() {
        return ResponseEntity.ok()
                .header("Access-Control-Allow-Origin", "*")
                .header("Access-Control-Allow-Methods", "GET")
                .body("Manual CORS configured");
    }
}

fetch('http://api.example.com/data', {
  method: 'PUT',
  headers: {
    'Content-Type': 'application/json',
    'X-Custom-Header': 'value'
  },
  body: JSON.stringify({key: 'value'})
});

// 替换为具体域名
.allowedOrigins("http://localhost:3000", "https://example.com")

@Bean
public FilterRegistrationBean<CorsFilter> corsFilterRegistration() {
    FilterRegistrationBean<CorsFilter> registration = new FilterRegistrationBean<>();
    registration.setFilter(corsFilter());
    registration.setOrder(Ordered.HIGHEST_PRECEDENCE);  // 最高优先级
    return registration;
}

@Configuration
public class ProdCorsConfig implements WebMvcConfigurer {
    
    @Value("${app.cors.allowed-origins}")
    private String[] allowedOrigins;
    
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
                .allowedOrigins(allowedOrigins)
                .allowedMethods("GET", "POST")
                .allowedHeaders("Content-Type", "Authorization")
                .exposeHeaders("X-Custom-Header")
                .allowCredentials(true)
                .maxAge(3600);
    }
}

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and()  // 启用Spring Security的CORS支持
            .csrf().disable()
            .authorizeRequests()
            // 其他配置...
    }
    
    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("https://trusted.com"));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

@Bean
public FilterRegistrationBean<CorsFilter> corsFilter() {
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    // ...配置
    
    FilterRegistrationBean<CorsFilter> registration = new FilterRegistrationBean<>();
    registration.setFilter(new CorsFilter(source) {
        @Override
        protected void doFilterInternal(HttpServletRequest request, 
            HttpServletResponse response, FilterChain filterChain) 
            throws ServletException, IOException {
            
            log.info("CORS请求: {} {}", request.getMethod(), request.getRequestURI());
            super.doFilterInternal(request, response, filterChain);
        }
    });
    return registration;
}

@SpringBootTest
@AutoConfigureMockMvc
public class CorsTest {
    
    @Autowired
    private MockMvc mockMvc;
    
    @Test
    public void testCorsHeaders() throws Exception {
        mockMvc.perform(options("/api/users")
                .header("Access-Control-Request-Method", "GET")
                .header("Origin", "http://localhost:3000"))
                .andExpect(header().exists("Access-Control-Allow-Origin"))
                .andExpect(header().string("Access-Control-Allow-Methods", "GET"));
    }
    
    @Test
    public void testActualRequest() throws Exception {
        mockMvc.perform(get("/api/users")
                .header("Origin", "http://localhost:3000"))
                .andExpect(status().isOk())
                .andExpect(header().string("Access-Control-Allow-Origin", "http://localhost:3000"));
    }
}