Spring Security Oauth2.0 ajax post请求跨域的解决方法

  • A+
所属分类：ajax Spring Security

最近项目中有单点登录的需求，用的是Spring Security Oauth2.0框架，授权的服务端已经写好，用postman测的也没问题。但是新建一个工程来获取token，就会报跨域的错。网上找了半天，发现写的都不是很全，有些注意的地方没有说的很清楚，特此记录。

首先，增加一个CorsFilter的过滤器。

  1. import org.springframework.context.annotation.Bean;
  2. import org.springframework.context.annotation.Configuration;
  3. import org.springframework.web.cors.CorsConfiguration;
  4. import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
  5. import org.springframework.web.filter.CorsFilter;
  7. @Configuration
  8. public class CorsConfig {
  9. @Bean
  10. public CorsFilter corsFilter() {
  11. final UrlBasedCorsConfigurationSource urlBasedCorsConfigurationSource = new UrlBasedCorsConfigurationSource();
  12. final CorsConfiguration corsConfiguration = new CorsConfiguration();
  13. corsConfiguration.setAllowCredentials(true);
  14. corsConfiguration.addAllowedOrigin("*");
  15. corsConfiguration.addAllowedHeader("*");
  16. corsConfiguration.addAllowedMethod("*");
  17. urlBasedCorsConfigurationSource.registerCorsConfiguration("/**", corsConfiguration);
  18. return new CorsFilter(urlBasedCorsConfigurationSource);
  19. }
  20. }
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;

@Configuration
public class CorsConfig {
    @Bean
    public CorsFilter corsFilter() {
        final UrlBasedCorsConfigurationSource urlBasedCorsConfigurationSource = new UrlBasedCorsConfigurationSource();
        final CorsConfiguration corsConfiguration = new CorsConfiguration();
        corsConfiguration.setAllowCredentials(true);
        corsConfiguration.addAllowedOrigin("*");
        corsConfiguration.addAllowedHeader("*");
        corsConfiguration.addAllowedMethod("*");
        urlBasedCorsConfigurationSource.registerCorsConfiguration("/**", corsConfiguration);
        return new CorsFilter(urlBasedCorsConfigurationSource);
    }
}

然后，在WebSecurityConfigurerAdapter的继承类里加上允许OPTIONS 方法，最后最关键的一点是，需要把@Order(1)改为@Order(-1)！！！！我就是没有设这一步导致怎么样都不行。改为-1后就可以正常得到token了。

  1. @Configuration
  2. @Order(-1)
  3. public class SecurityConfig extends WebSecurityConfigurerAdapter {
  5. @Override
  6. protected void configure(HttpSecurity http) throws Exception {
  7. http.requestMatchers()
  8. .antMatchers(HttpMethod.OPTIONS,"/login", "/oauth/authorize", "/oauth/token")
  9. .and()
  10. .authorizeRequests()
  11. .anyRequest().authenticated()
  12. .and()
  13. .formLogin().permitAll()
  14. .and()
  15. .cors()
  16. .and()
  17. .csrf().disable();
  18. }
@Configuration
@Order(-1)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.requestMatchers()
                .antMatchers(HttpMethod.OPTIONS,"/login", "/oauth/authorize", "/oauth/token")
                .and()
                .authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .formLogin().permitAll()
                .and()
                .cors()
                .and()
                .csrf().disable();
    }