Spring引導OAuth2 - OAuth令牌不返回授權令牌

我遇到此錯誤。Spring引導OAuth2 - OAuth令牌不返回授權令牌

XMLHttpRequest cannot load http://localhost:8080/oauth/token. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access. The response had HTTP status code 401.

我已經添加了我的cors過濾器。

@Component 
public class CorsFilter implements Filter { 

    @Override 
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { 

     HttpServletRequest request = (HttpServletRequest) req; 
     HttpServletResponse response = (HttpServletResponse) res; 
     response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin")); 
     response.setHeader("Access-Control-Allow-Credentials", "true"); 
     response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE"); 
     response.setHeader("Access-Control-Max-Age", "3600"); 
     response.setHeader("Access-Control-Allow-Headers", "origin,Content-Type, Accept, X-Requested-With, remember-me"); 
     if(request.getHeader("request").equalsIgnoreCase("options")) { 
      response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin")); 
     } 
     chain.doFilter(req, res); 
    } 

    @Override 
    public void init(FilterConfig filterConfig) { 
    } 

    @Override 
    public void destroy() { 
    } 

}

可能安全配置是這樣的。

//Added Swagger to ignore lists 
     http.authorizeRequests() 
       .antMatchers(
         "/swagger-ui.html", 
         "/webjars/springfox-swagger-ui/**", 
         "/configuration/ui", 
         "/oauth/token", 
         "/v2/**", 
         "/register", 
         "/swagger-resources", 
         "/clinic", 
         "/reindex", 
         "/rating/featured-rating", 
         "/doctor/*", 
         "/doctor/clinic/*", 
         "/doctor/profile/*", 
         "/clinic/profile/*", 
         "/**/*.html", 
         "/app/**", 
         "/assets/**", 
         "/fonts/*", 
         "/styles/images/*", 
         "/", 
         "/search-term", 
         "/search/detail", 
         "/location", 
         "/verify", 
         "/register", 
         "/doctor/register/request", 
         "/rating/create", 
         "/rating/has-like", 
         "/rating/like", 
         "/doctor/download/**", 
         "/clinic/download/**", 
         "/patient/references/*", 
         "/vanilla", 
         "/rating/featured-rating", 
         "/reset", 
         "/validate-pass", 
         "/change-pass", 
         "/save-pass", 
         "/users", 
         "/events/report").permitAll() 
       .anyRequest().authenticated() 
       .and().csrf().disable(); 

     http.authorizeRequests() 
       .antMatchers(HttpMethod.OPTIONS, "/**").permitAll(); 
     http.headers() 
       .xssProtection().and() 
       .cacheControl().and() 
       .httpStrictTransportSecurity().and() 
       .frameOptions();

這是我的錯誤

的還有什麼我錯過的截圖？

編輯

我已經更新了我的CORS配置成以下

import org.springframework.core.Ordered; 
import org.springframework.core.annotation.Order; 
import org.springframework.stereotype.Component; 

import javax.servlet.*; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 
import java.io.IOException; 
import java.util.Enumeration; 

    @Component 
    @Order(Ordered.HIGHEST_PRECEDENCE) 
    public class CorsFilter implements Filter { 

     @Override 
     public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { 

      HttpServletRequest request = (HttpServletRequest) req; 
      HttpServletResponse response = (HttpServletResponse) res; 
      response.setHeader("Access-Control-Allow-Origin", request.getHeader("Origin")); 
      response.setHeader("Access-Control-Allow-Credentials", "true"); 
      response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE"); 
      response.setHeader("Access-Control-Max-Age", "3600"); 
      response.setHeader("Access-Control-Allow-Headers", "Content-Type, Accept, X-Requested-With, remember-me"); 

      request.getHeaderNames(); 

      if(request.getMethod().equalsIgnoreCase("OPTIONS")) { 
      } else { 
       chain.doFilter(req, res); 
      } 

      //chain.doFilter(req, res); 
     } 

     @Override 
     public void init(FilterConfig filterConfig) { 
     } 

     @Override 
     public void destroy() { 
     } 

    }

不過，現在的迴應就是這樣

可用authorization_token沒有響應這這個應用程序需要調用/ o認證/令牌

來源

2016-05-11 user962206

按照this post需要兩個變化：

確保過濾器是通過將@Ordered註解Spring Security的過濾器之前加載。

import org.springframework.core.Ordered; 
import org.springframework.core.annotation.Order; 

@Component 
@Order(Ordered.HIGHEST_PRECEDENCE) 
class CorsFilter implements Filter {

您應該打破OPTION請求方法的過濾器鏈。

if(request.getHeader("request").equalsIgnoreCase("options")) { 
    // ... 
} else { 
    chain.doFilter(req, res); 
}

另外，我不明白爲什麼你設置if語句裏面的Access-Control-Allow-Origin頭，因爲你的條件之前做到這一點。

來源

2016-05-11 10:22:32

Spring引導OAuth2 - OAuth令牌不返回授權令牌

回答

相關問題