响应中的访问控制允许凭据标头为" "，必须为"true"

Question

我正在尝试向REST api发送注释。该其余API已经为我的应用程序地址设置了CORS。

后端

@RestController
@CrossOrigin(origins = "http://localhost:8000", allowedHeaders = "*", methods = {RequestMethod.GET,RequestMethod.POST,RequestMethod.DELETE,RequestMethod.PUT})
@RequestMapping("/api")
public class CommentController {
@Autowired
private CommentRepository commentRepository;
// Get All Comments From a certain workitemId
@GetMapping("/comments/{workitemId}")
public List<Comment> getTicketHistory(@PathVariable Long workitemId) {
return commentRepository.getCommentsByWorkitemId(workitemId);
}
// Create a comment related with a given Workitem
@PostMapping("/comment")
public boolean createComment(@RequestBody Comment comment) {
commentRepository.save(comment);
return true;
}
}

但我得到

无法加载 http://localhost:8999/api/comment：响应 预检请求未通过访问控制检查：的值 响应中的"访问控制允许凭据"标头为"，其中 当请求的凭据模式为"包含"时，必须为"true"。 因此，不允许访问源"http://localhost:8000"。这 由 XMLHttpRequest 发起的请求的凭据模式为 由 withCredentials 属性控制。

我的代码：

$http.post(baseUrl + "/comment", vm.comment).then(
function(response) {
// success callback
console.log("Comment Submitted!");
},
function(response) {
// failure call back
console.log("Error while submitting the comment");
});

Answer 1

尝试在注释中添加allowCredentials = "true"@CrossOrigin为，

@CrossOrigin(
allowCredentials = "true",
origins = "http://localhost:8000", 
allowedHeaders = "*", 
methods = {RequestMethod.GET,RequestMethod.POST,RequestMethod.DELETE,RequestMethod.PUT}
)

这可能会起作用。

Answer 2

你忘了添加：

allowCredentials=true

它应该是：

@CrossOrigin(origins = "http://localhost:8000", allowCredentials = "true", allowedHeaders = "*", methods = {RequestMethod.GET,RequestMethod.POST,RequestMethod.DELETE,RequestMethod.PUT})