Apache Tomcat 8.5.2 + Resteasy CORS過濾器突然停止工作

我有一個在嵌入式Apache Tomcat（8.5.2）實例上運行的JAX-RS應用程序（RestEasy，3.1.2.Final）。這是一個公共REST服務，所以我增加了從RestEasy的一個CORS過濾器，以它：Apache Tomcat 8.5.2 + Resteasy CORS過濾器突然停止工作

import org.jboss.resteasy.plugins.interceptors.CorsFilter; 

@Override 
    public Set<Object> getSingletons() { 
     Set<Object> singletons = new LinkedHashSet<>(); 

     // = = = CORS = = = 
     CorsFilter cors = getCorsFilter(); 
     singletons.add(cors); 

     //... 

     return singletons; 
    } 

    private CorsFilter getCorsFilter() { 
     CorsFilter cors = new CorsFilter(); 
     cors.getAllowedOrigins().add("*"); 
     cors.setAllowCredentials(true); 
     cors.setAllowedMethods("GET,POST,PUT,DELETE,HEAD"); 
     cors.setCorsMaxAge(1209600); 
     cors.setAllowedHeaders("Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Authorization,Accept-Encoding,Accept-Language,Access-Control-Request-Method,Cache-Control,Connection,Host,Referer,User-Agent"); 
     return cors; 
    }

有在web.xml中定義以及安全性約束：

<security-constraint> 
     <web-resource-collection> 
      <web-resource-name>Tango RESTful gateway</web-resource-name> 
      <url-pattern>/rest/*</url-pattern> 
      <http-method>GET</http-method> 
      <http-method>HEAD</http-method> 
      <http-method>POST</http-method> 
      <http-method>PUT</http-method> 
      <http-method>DELETE</http-method> 
     </web-resource-collection> 
     <auth-constraint> 
      <role-name>desy-user</role-name> 
      <role-name>mtango-rest</role-name> 
     </auth-constraint> 
    </security-constraint>

在此設置一切正常很好，但幾周。幾個星期之後CORS預檢失敗的401，而不是正常序列：

請求：

Host: mstatus.esrf.fr 
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: en-US,en;q=0.5 
Accept-Encoding: gzip, deflate, br 
Access-Control-Request-Method: GET 
Access-Control-Request-Headers: authorization 
Origin: https://ingvord.github.io 
DNT: 1 
Connection: keep-alive

響應：

Connection: Keep-Alive 
Content-Length: 62 
Content-Type: application/octet-stream 
Date: Sun, 17 Sep 2017 07:28:19 GMT 
Keep-Alive: timeout=5, max=85 
Server: Apache-Coyote/1.1

顯然CORS過濾器不再執行 - 沒有響應頭它設置。

什麼可能是這種行爲的原因？重新啓動後，它再次運行幾個星期。

應用程序鏈接：https://ingvord.github.io/tango-controls.demo/

由於提前，

來源

2017-09-17 Ingvord

顯然，它似乎在web.xml中進行以下額外的配置已經解決了這個問題：

<security-constraint> 
    <web-resource-collection> 
     <web-resource-name>CORS preflight</web-resource-name> 
     <url-pattern>/*</url-pattern> 
     <http-method>OPTIONS</http-method> 
    </web-resource-collection> 
</security-constraint>

嗯，至少我們不觀察相當長時間內的任何不當行爲。

來源

2018-02-13 12:01:29 Ingvord

Apache Tomcat 8.5.2 + Resteasy CORS過濾器突然停止工作

回答

相關問題