在春季启动2.4.0版本中更改CORS策略

Question

使用Spring 2.3.0.RELEASE，我进行了以下CORS确认：

@Configuration
@EnableWebSecurity
@ComponentScan("com.softeq.ems.config")
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class EmsJwtSecurityConfig extends BaseSecurityConfig {
@Value("${management.endpoints.web.cors.allowed-origins}")
private String[] allowedOrigins;
@Override
protected void configureHttp(HttpSecurity http) throws Exception {
if (allowedOrigins.length > 0) {
http.cors().configurationSource(corsConfigSource());
}
http.csrf().disable();
}
private CorsConfigurationSource corsConfigSource() {
final CorsConfiguration corsConfig = new CorsConfiguration();
corsConfig.addAllowedHeader(CorsConfiguration.ALL);
corsConfig.addAllowedMethod(CorsConfiguration.ALL);
Stream.of(allowedOrigins).forEach(
origin -> corsConfig.addAllowedOrigin(origin)
);
return request -> corsConfig;
}

变量management.endpoints.web.cors.allowed-origins = http://localhost:4200, http://127.0.0.1:4200

这种配置运行良好，我需要的所有跨平台请求都得到了授权。

但在发布后迁移到spring-boot2.4.0后，当我像往常一样尝试向主机发送请求时，我在chrome浏览器控制台中得到了经典的cors策略错误：

Access to XMLHttpRequest at 'http://localhost:8080/api/v1/me/balance' from origin 'http://localhost:4200' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status

Spring发布说明说cors配置提供了一个新的属性allowedOriginPatterns，但我不知道如何使用它：https://github.com/spring-projects/spring-framework/wiki/What%27s-新的Spring-Framework-5.x#通用web修订版

请帮我弄清楚我的问题是什么！

Answer 1

以下是我对您的代码所做的操作：

private CorsConfigurationSource corsConfigSource() {
final CorsConfiguration corsConfig = new CorsConfiguration();
corsConfig.addAllowedHeader(CorsConfiguration.ALL);
corsConfig.addAllowedMethod(CorsConfiguration.ALL);
Stream.of(allowedOrigins).forEach(
//origin -> corsConfig.addAllowedOrigin(origin)
origin -> corsConfig.addAllowedOriginPattern(origin)
);
return request -> corsConfig;
}

Answer 2

我是这样做的：

@Configuration
@Profile("!production")
class CorsConfig : WebMvcConfigurer {
override fun addCorsMappings(registry: CorsRegistry) {
registry
.addMapping("/**")
.allowedOriginPatterns("http://localhost:3000")
}
}