Spring Security使用Oauth2时的跨域问题

本文讲述的是访问oauth/token的时候发生跨域问题，但已经加了cros还是不能解决的

通过日志查看得知，是因为Spring Security启动了两个过滤链

o.s.s.web.DefaultSecurityFilterChain : Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/oauth/token'], Ant [pattern='/oauth/token_key'], Ant [pattern='/oauth/check_token']]], [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@e4348c0, org.springframework.security.web.context.SecurityContextPersistenceFilter@1382a7d8, org.springframework.security.web.header.HeaderWriterFilter@60e80279, org.springframework.security.web.authentication.logout.LogoutFilter@568c9ee1, org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter@285c63cf, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@6f1163f7, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@6074d638, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@402feb85, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@4ca907af, org.springframework.security.web.session.SessionManagementFilter@7fc56d61, org.springframework.security.web.access.ExceptionTranslationFilter@45b6c666, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@7e451790]

o.s.s.web.DefaultSecurityFilterChain : Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/login'], Ant [pattern='/oauth/authorize'], Ant [pattern='/oauth/token'], Ant [pattern='/sms/validate'], Ant [pattern='/user']]], [com.eryun.identity.server.config.CustomerCorsFilter@3b0ed98a, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@76c587ce, org.springframework.security.web.context.SecurityContextPersistenceFilter@2ae5580, org.springframework.security.web.header.HeaderWriterFilter@533d7c61, org.springframework.web.filter.CorsFilter@2ae7c1d, org.springframework.security.web.authentication.logout.LogoutFilter@3fc5d397, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@7d82ca56, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@36eb8e07, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@5265a8dd, org.springframework.security.web.session.SessionManagementFilter@470f0637, org.springframework.security.web.access.ExceptionTranslationFilter@48f4264e, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@e4bb10b]

/oauth/*被加入到另一个Spring Security自己的过滤链了，没有进入我自己写的 CustomerCorsFilter 里，那就只能把自己的过滤链先于系统自带的加载才行

package com.eryun.identity.server.config;import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;import java.util.Arrays;
import java.util.List;
@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class CustomerCorsFilter extends org.springframework.web.filter.CorsFilter {public CustomerCorsFilter() {super(configurationSource());}private static UrlBasedCorsConfigurationSource configurationSource() {CorsConfiguration corsConfig = new CorsConfiguration();List<String> allowedHeaders = Arrays.asList("x-auth-token", "content-type", "X-Requested-With", "XMLHttpRequest","Access-Control-Allow-Origin","Authorization","authorization");List<String> exposedHeaders = Arrays.asList("x-auth-token", "content-type", "X-Requested-With", "XMLHttpRequest","Access-Control-Allow-Origin","Authorization","authorization");List<String> allowedMethods = Arrays.asList("POST", "GET", "DELETE", "PUT", "OPTIONS");List<String> allowedOrigins = Arrays.asList("*");corsConfig.setAllowedHeaders(allowedHeaders);corsConfig.setAllowedMethods(allowedMethods);corsConfig.setAllowedOrigins(allowedOrigins);corsConfig.setExposedHeaders(exposedHeaders);corsConfig.setMaxAge(36000L);corsConfig.setAllowCredentials(true);UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();source.registerCorsConfiguration("/**", corsConfig);return source;}
}

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {@Autowiredprivate CustomerCorsFilter customerCorsFilter;@Autowiredprivate UserDetailsConfig userDetailsConfig;@Overrideprotected void configure(HttpSecurity http) throws Exception {http.cors().and().authorizeRequests().antMatchers("/login", "/oauth/authorize", "/oauth/token", "/sms/validate", "/user").permitAll().anyRequest().authenticated().and().formLogin().permitAll().and().csrf().disable().addFilterBefore(customerCorsFilter, WebAsyncManagerIntegrationFilter.class);}
}

Spring Security使用Oauth2时的跨域问题相关推荐

Spring Boot集成Ueditor富文本编辑器，实现图片上传，视频上传，返回内容功能并且通过OSS转换为链接并且解决Spring Security静态资源访问以及跨域问题
学习自https://cloud.tencent.com/developer/article/1452451 现在是晚上22点,刚刚和我们的前端交流完了富文本编辑器的一些意见和看法还是老样子需求 ...
Spring Security、oauth2、单点登陆SSO的关系
文章目录概述 1. 什么是Spring Security 1.1 配置示例 1.2 spring security 基本原理 1.2 Spring Security存在的问题 2. 什么是oauth ...
Spring Security 与 OAuth2 介绍
个人 OAuth2 全部文章 Spring Security 与 OAuth2(介绍):https://www.jianshu.com/p/68f22f9a00ee Spring Security 与 ...
angular5使用httpclient时解决跨域问题
angular5使用httpclient时解决跨域问题参考文章: (1)angular5使用httpclient时解决跨域问题 (2)https://www.cnblogs.com/modou/p/ ...
m3u8下载时出现跨域的解决方法
m3u8下载时出现跨域复制下面的代码当无法下载,资源发生跨域限制时,在视频源页面打开控制台,注入代码解决,点击复制下面代码 // 注入htmllet $section = document.crea ...
SpringBoot中配置拦截器时，跨域失效
SpringBoot中配置拦截器时,跨域失效前后段分离的项目,配置了跨域后,访问正常,但是配置了拦截器以后,有的访问正常,有的出现跨域问题,发现出现跨域问题的都是拦截器里面没有放行的请求. @Con ...
关于 Spring Security OAuth2 中 CORS 跨域问题
CORS 是一个 W3C 标准,全称是"跨域资源共享"(Cross-origin resource sharing).它允许浏览器向跨源服务器,发出XMLHttpRequest请求 ...
Spring Boot笔记-解决前后端分离在开发时的跨域问题
这里可以用Nginx解决跨越问题,也可以用下面这种方式在开发时解决: @Configuration public class CorsConfig implements WebMvcConfigure ...
微信公众号网页版，获取用户code时出现跨域问题的解决办法之一
前提是微信公众号后台设置没有问题. 网页授权域名不要设置有问题根据微信[官方文档] 第一步:用户同意授权,获取code 在确保微信公众账号拥有授权作用域(scope参数)的权限的前提下(服务号获得高 ...
Spring boot使用Spring Security和OAuth2保护REST接口
在本文中,我将会演示SpringSecurity+OAuth2如何去保护SpringBoot上的RESTAPI端点,以及客户端和用户凭证如何存储在关系数据库中.因此,我们需要做到以下几点: 配置Spr ...

Spring Security使用Oauth2时的跨域问题

Spring Security使用Oauth2时的跨域问题相关推荐

最新文章

热门文章