这段代码确实有效：

import com.example.myAuthServer.service.CustomUserDetailsService;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Lazy;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    private final CustomUserDetailsService customUserDetailsService;
    private final AuthConfigProperties authConfigProperties;

    public WebSecurityConfig(@Lazy CustomUserDetailsService customUserDetailsService, AuthConfigProperties authConfigProperties) {
        this.customUserDetailsService = customUserDetailsService;
        this.authConfigProperties = authConfigProperties;
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManager() throws Exception {
        return super.authenticationManager();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(authConfigProperties.getBcryptRounds());
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .cors()
                .and()
                .requestMatchers()
                .antMatchers("/login", "/logout", "/oauth/authorize")
                .and()
                .logout()
                .deleteCookies("JSESSIONID")
                .permitAll()
                .and()
                .authorizeRequests()
                .anyRequest()
                .authenticated()
                .and()
                .csrf()
                .disable();

    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(customUserDetailsService).passwordEncoder(passwordEncoder());
    }

}

但是为了得到在原始帖子中显示的错误的红色，你只需要让浏览器知道请求的服务器url具有相同的“允许控制访问源”响应的url。
我们可以通过在客户端应用一个代理来实现这一点，在我的例子中，我使用react。
请在src目录下添加一个名为setupProxy.js的文件。
然后编写以下代码：

const proxy = require("http-proxy-middleware");

module.exports = function (app) {
    app.use(proxy("/oauth/token", {target: "http://localhost:8089"})); // put your host and api
};

并像这样使用它：

fetch("/oauth/token", {
            method: "POST",
            body: qs.stringify(Auth.bodyForNewToken(username, password)),
            headers: {
                "Content-Type": "application/x-www-form-urlencoded",
                Authorization: "Basic " + btoa("<CLIENT>:<SECRET>")
            }
        });

这段代码只是一个提示，您需要更改必要行！！！.

处理此问题的一种方法是添加WebMvcConfigurer。虽然使用此方法，但您应该考虑环境配置文件（开发、生产等），并且可以保留WebSecurityConfigurerAdapter的默认配置。（无需禁用它）
举个例子：

@Configuration
public class WebMvc implements WebMvcConfigurer {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
                .allowedMethods("*")
                .allowedOrigins("*");
    }
}

自2022年起更新，类WebSecurityConfigurerAdapter已弃用。因此，您需要提供SecurityFilterChain类型的bean。您可以使用以下代码片段禁用cors -

@EnableWebSecurity(debug = true)
public class SecurityConfiguration {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
                .cors().disable()
                .build();
    }
}