java 正在获取401以访问

wz1wpwve  于 2022-10-30  发布在  Java
关注(0)|答案(2)|浏览(165)

我从我的angularjs客户端应用程序点击一个端点登录时,我正在做一个我在浏览器控制台中得到以下错误
选项http://localhost:8080/oauth/token XMLHttpRequest无法加载http://localhost:8080/oauth/token。HTTP状态代码401无效
它是服务器端代码,用于接受来自客户端的CORS。

  1. @Component
  2. public class SimpleCORSFilter implements Filter {
  3. public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
  4. HttpServletResponse response = (HttpServletResponse) res;
  5. response.setHeader("Access-Control-Allow-Origin", "*");
  6. response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
  7. response.setHeader("Access-Control-Max-Age", "3600");
  8. response.setHeader("Access-Control-Allow-Headers", "x-requested-with");
  9. chain.doFilter(req, res);
  10. }
  11. public void init(FilterConfig filterConfig) {}
  12. public void destroy() {}
  13. }

这是客户端代码,调用http://localhost:8080/oauth/token

  1. angular.module('frontendApp')
  2. .factory('AuthServerProvider', function loginService($http, localStorageService, Base64, API_SERVER) {
  3. return {
  4. login: function (credentials) {
  5. var data = "username=" + credentials.username + "&password="
  6. + credentials.password + "&grant_type=password&scope=read%20write&" +
  7. "client_secret=123456&client_id=clientapp";
  8. return $http.post(API_SERVER + 'oauth/token', data, {
  9. headers: {
  10. "Content-Type": "application/x-www-form-urlencoded",
  11. "Accept": "application/json",
  12. "Access-Control-Allow-Origin": "*",
  13. "Authorization": "Basic " + Base64.encode("clientapp" + ':' + "123456")
  14. }
  15. }).success(function (response) {
  16. var expiredAt = new Date();
  17. expiredAt.setSeconds(expiredAt.getSeconds() + response.expires_in);
  18. response.expires_at = expiredAt.getTime();
  19. localStorageService.set('token', response);
  20. return response;
  21. });
  22. },
  23. logout: function () {
  24. // logout from the server
  25. $http.post('api/logout').then(function () {
  26. localStorageService.clearAll();
  27. });
  28. },
  29. getToken: function () {
  30. return localStorageService.get('token');
  31. },
  32. hasValidToken: function () {
  33. var token = this.getToken();
  34. return token && token.expires_at && token.expires_at > new Date().getTime();
  35. }
  36. };
  37. });
vhmi4jdf

vhmi4jdf1#

如果是OPTIONS请求,则不应进行进一步处理,即跳过对chain.doFilter(req, res)的调用,例如:

  1. HttpServletRequest request = (HttpServletRequest) req;
  2. HttpServletResponse response = (HttpServletResponse) resp;
  3. response.addHeader("Access-Control-Allow-Origin", "*");
  4. if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
  5. response.setHeader("Access-Control-Allow-Methods", "POST,GET,DELETE");
  6. response.setHeader("Access-Control-Max-Age", "3600");
  7. response.setHeader("Access-Control-Allow-Headers", "content-type,access-control-request-headers,access-control-request-method,accept,origin,authorization,x-requested-with");
  8. response.setStatus(HttpServletResponse.SC_OK);
  9. } else {
  10. chain.doFilter(req, resp);
  11. }
mi7gmzs6

mi7gmzs62#

对于Oauth2,您将拥有此扩展AuthorizationServerConfigurerAdapter的配置类。

  1. @Configuration
  2. @EnableAuthorizationServer
  3. public static class AuthServerConfiguration extends AuthorizationServerConfigurerAdapter {
  4. @Override
  5. public void configure(AuthorizationServerSecurityConfigurer security) {
  6. UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  7. CorsConfiguration config = new CorsConfiguration();
  8. config.applyPermitDefaultValues();
  9. AuthorizationServerEndpointsConfigurer
  10. source.registerCorsConfiguration("/oauth/token", config);
  11. CorsFilter filter = new CorsFilter(source);
  12. security.addTokenEndpointAuthenticationFilter(filter);
  13. }
  14. }

这将为Oauth添加cors的配置

展开查看全部

相关问题