CORS

DeepSeek V3 中英对照 Spring’s CORS Support CORS

Spring Framework 提供了 对 CORS 的一流支持。CORS 必须在 Spring Security 之前处理，因为预检请求不包含任何 cookie（即 JSESSIONID）。如果请求不包含任何 cookie 且 Spring Security 先执行，该请求会被判定为用户未认证（因为请求中没有 cookie）并遭到拒绝。

确保CORS首先得到处理的最简单方法是使用CorsFilter。用户可以通过提供一个CorsConfigurationSource来将CorsFilter与Spring Security集成。请注意，只有当存在UrlBasedCorsConfigurationSource实例时，Spring Security才会自动配置CORS。例如，以下代码将在Spring Security中集成CORS支持：

Java

@Bean
UrlBasedCorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Arrays.asList("https://example.com"));
    configuration.setAllowedMethods(Arrays.asList("GET","POST"));
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

Kotlin

@Bean
fun corsConfigurationSource(): UrlBasedCorsConfigurationSource {
    val configuration = CorsConfiguration()
    configuration.allowedOrigins = listOf("https://example.com")
    configuration.allowedMethods = listOf("GET", "POST")
    val source = UrlBasedCorsConfigurationSource()
    source.registerCorsConfiguration("/**", configuration)
    return source
}

以下清单在 XML 中实现了相同的功能：

<http>
	<cors configuration-source-ref="corsSource"/>
	...
</http>
<b:bean id="corsSource" class="org.springframework.web.cors.UrlBasedCorsConfigurationSource">
	...
</b:bean>

如果你使用 Spring MVC 的 CORS 支持，可以省略指定 CorsConfigurationSource，Spring Security 将直接使用提供给 Spring MVC 的 CORS 配置：

Java

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

	@Bean
	public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
		http
			// if Spring MVC is on classpath and no CorsConfigurationSource is provided,
			// Spring Security will use CORS configuration provided to Spring MVC
			.cors(withDefaults())
			...
		return http.build();
	}
}

Kotlin

@Configuration
@EnableWebSecurity
open class WebSecurityConfig {
    @Bean
    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
        http {
            // if Spring MVC is on classpath and no CorsConfigurationSource is provided,
            // Spring Security will use CORS configuration provided to Spring MVC
            cors { }
            // ...
        }
        return http.build()
    }
}

以下清单在 XML 中实现了相同的功能：

<http>
	<!-- Default to Spring MVC's CORS configuration -->
	<cors />
	...
</http>

如果你定义了多个 CorsConfigurationSource Bean，Spring Security 将不会自动为你配置 CORS 支持，因为它无法决定使用哪一个。如果你想为每个 SecurityFilterChain 指定不同的 CorsConfigurationSource，可以直接将其传入 .cors() DSL 中。

Java

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

	@Bean
	@Order(0)
	public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception {
		http
			.securityMatcher("/api/**")
			.cors((cors) -> cors
				.configurationSource(apiConfigurationSource())
			)
			...
		return http.build();
	}

	@Bean
	@Order(1)
	public SecurityFilterChain myOtherFilterChain(HttpSecurity http) throws Exception {
		http
			.cors((cors) -> cors
				.configurationSource(myWebsiteConfigurationSource())
			)
			...
		return http.build();
	}

	UrlBasedCorsConfigurationSource apiConfigurationSource() {
		CorsConfiguration configuration = new CorsConfiguration();
		configuration.setAllowedOrigins(Arrays.asList("https://api.example.com"));
		configuration.setAllowedMethods(Arrays.asList("GET","POST"));
		UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
		source.registerCorsConfiguration("/**", configuration);
		return source;
	}

	UrlBasedCorsConfigurationSource myWebsiteConfigurationSource() {
		CorsConfiguration configuration = new CorsConfiguration();
		configuration.setAllowedOrigins(Arrays.asList("https://example.com"));
		configuration.setAllowedMethods(Arrays.asList("GET","POST"));
		UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
		source.registerCorsConfiguration("/**", configuration);
		return source;
	}

}

Kotlin

@Bean
fun corsConfigurationSource(): UrlBasedCorsConfigurationSource {
    val configuration = CorsConfiguration()
    configuration.allowedOrigins = listOf("https://example.com")
    configuration.allowedMethods = listOf("GET", "POST")
    val source = UrlBasedCorsConfigurationSource()
    source.registerCorsConfiguration("/**", configuration)
    return source
}

注意

CORS 是一种基于浏览器的安全特性。通过在 Spring Security 中使用 .cors(CorsConfigurer::disable) 来禁用 CORS，你并没有从浏览器中移除 CORS 保护。相反，你移除了 Spring Security 中的 CORS 支持，用户将无法从跨域浏览器应用程序与你的 Spring 后端进行交互。要修复应用程序中的 CORS 错误，你必须启用 CORS 支持，并提供适当的配置源。