Solve cross-domain issues by setting response headers

private class PreFlightHandler implements HttpRequestHandler, CorsConfigurationSource {<!-- -->

@Nullable
private final CorsConfiguration config;

public PreFlightHandler(@Nullable CorsConfiguration config) {<!-- -->
this.config = config;
}

@Override
public void handleRequest(HttpServletRequest request, HttpServletResponse response) throws IOException {<!-- -->
corsProcessor.processRequest(this.config, request, response);
}

@Override
@Nullable
public CorsConfiguration getCorsConfiguration(HttpServletRequest request) {<!-- -->
return this.config;
}
}

public class DefaultCorsProcessor implements CorsProcessor {<!-- -->

private static final Log logger = LogFactory.getLog(DefaultCorsProcessor.class);


@Override
@SuppressWarnings("resource")
public boolean processRequest(@Nullable CorsConfiguration config, HttpServletRequest request,
HttpServletResponse response) throws IOException {<!-- -->

Collection<String> varyHeaders = response.getHeaders(HttpHeaders.VARY);
if (!varyHeaders.contains(HttpHeaders.ORIGIN)) {<!-- -->
response.addHeader(HttpHeaders.VARY, HttpHeaders.ORIGIN);
}
if (!varyHeaders.contains(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD)) {<!-- -->
response.addHeader(HttpHeaders.VARY, HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD);
}
if (!varyHeaders.contains(HttpHeaders.ACCESS_CONTROL_REQUEST_HEADERS)) {<!-- -->
response.addHeader(HttpHeaders.VARY, HttpHeaders.ACCESS_CONTROL_REQUEST_HEADERS);
}

if (!CorsUtils.isCorsRequest(request)) {<!-- -->
return true;
}

if (response.getHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN) != null) {<!-- -->
logger.trace("Skip: response already contains "Access-Control-Allow-Origin"");
return true;
}

boolean preFlightRequest = CorsUtils.isPreFlightRequest(request);
if (config == null) {<!-- -->
if (preFlightRequest) {<!-- -->
rejectRequest(new ServletServerHttpResponse(response));
return false;
}
else {<!-- -->
return true;
}
}

return handleInternal(new ServletServerHttpRequest(request), new ServletServerHttpResponse(response), config, preFlightRequest);
}

protected boolean handleInternal(ServerHttpRequest request, ServerHttpResponse response,
CorsConfiguration config, boolean preFlightRequest) throws IOException {<!-- -->

String requestOrigin = request.getHeaders().getOrigin();
String allowOrigin = checkOrigin(config, requestOrigin);
HttpHeaders responseHeaders = response.getHeaders();

if (allowOrigin == null) {<!-- -->
logger.debug("Reject: '" + requestOrigin + "' origin is not allowed");
rejectRequest(response);
return false;
}

HttpMethod requestMethod = getMethodToUse(request, preFlightRequest);
List<HttpMethod> allowMethods = checkMethods(config, requestMethod);
if (allowMethods == null) {<!-- -->
logger.debug("Reject: HTTP '" + requestMethod + "' is not allowed");
rejectRequest(response);
return false;
}

List<String> requestHeaders = getHeadersToUse(request, preFlightRequest);
List<String> allowHeaders = checkHeaders(config, requestHeaders);
if (preFlightRequest & amp; & amp; allowHeaders == null) {<!-- -->
logger.debug("Reject: headers '" + requestHeaders + "' are not allowed");
rejectRequest(response);
return false;
}

responseHeaders.setAccessControlAllowOrigin(allowOrigin);

if (preFlightRequest) {<!-- -->
responseHeaders.setAccessControlAllowMethods(allowMethods);
}

if (preFlightRequest & amp; & amp; !allowHeaders.isEmpty()) {<!-- -->
responseHeaders.setAccessControlAllowHeaders(allowHeaders);
}

if (!CollectionUtils.isEmpty(config.getExposedHeaders())) {<!-- -->
responseHeaders.setAccessControlExposeHeaders(config.getExposedHeaders());
}

if (Boolean.TRUE.equals(config.getAllowCredentials())) {<!-- -->
responseHeaders.setAccessControlAllowCredentials(true);
}

if (preFlightRequest & amp; & amp; config.getMaxAge() != null) {<!-- -->
responseHeaders.setAccessControlMaxAge(config.getMaxAge());
}

response.flush();
return true;
}

springMvc will handle cross-domain requests based on cross-domain configuration.

Configuring cross-domain

 @Override
    public void addCorsMappings(CorsRegistry registry) {<!-- -->
        registry.addMapping("/**")
                .allowedOrigins("*")
                .allowCredentials(true)
                .allowedMethods("GET", "POST", "DELETE", "PUT", "PATCH");
    }

You can configure the above CorsConfiguration through the configuration class
However, the new version of springMvc has prohibited simultaneous settings.
allowCredentials is true
allowCredentials is false
If you have this requirement, you need to write your own interceptor to handle it.

/ Cross-domain interceptor
public class CrosInterceptor implements HandlerInterceptor {<!-- -->
    //Intercept before accessing
    @Override
    public boolean preHandle(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, Object o) {<!-- -->
      //Set response headers
        httpServletResponse.setHeader("Access-Control-Allow-Origin", "*");
        httpServletResponse.setHeader("Access-Control-Allow-Headers", "*");
        httpServletResponse.setHeader("Access-Control-Allow-Methods", "*");
        httpServletResponse.setHeader("Access-Control-Max-Age", "3600");
        httpServletResponse.setHeader("Access-Control-Allow-Credentials", "true");


        return true;
    }
}

Configure interceptor

 @Override
    public void addInterceptors(InterceptorRegistry registry) {<!-- -->
        registry.addInterceptor(authenticationInterceptor())
                .addPathPatterns("/**"); // Intercept all requests and determine whether login is required by judging whether there is @LoginRequired annotation

        registry.addInterceptor(reqIdHandler())
                .addPathPatterns("/**"); //Verify whether the corpId is consistent

        registry.addInterceptor(new CrosInterceptor())
                .addPathPatterns("/**");
    }

Interceptor skips OPTIONS request

However, you need to pay attention to prevent the server’s interceptor from intercepting the OPTIONS request, causing the preflight to fail and reporting a cross-domain error
For example, this will lead to cross-domain errors.

@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {<!-- -->
String token = request.getHeader(Constants.TOKEN);

\t
\t
if (StrUtil.isEmpty(token)) {<!-- -->
throw new TokenException("Token is empty");
}

    }

Judgment should be added to the interceptor

@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {<!-- -->
if("OPTIONS".equals(request.getMethod())){<!-- -->
return true;
}
\t
        String token = request.getHeader(Constants.TOKEN);
       
if (StrUtil.isEmpty(token)) {<!-- -->
throw new TokenException("Token is empty");
}

    }