Spring Boot Sping Boot 总是抛出403和CORS策略错误

qncylg1j  于 2024-01-06  发布在  Spring
关注(0)|答案(2)|浏览(234)

我是Sping Boot 和VueJS的新手。我正在开发一个Web应用程序,使用Vue前端和Sping Boot 后端,通过Google SDK登录Google。前端和后端工作正常,但两者之间的通信不起作用。当我试图通过BackendService.js向后端发出GET调用时,我在浏览器控制台中收到以下错误消息。

  1. Access to XMLHttpRequest at 'BACKEND_URL/match/231' from origin 'FRONTEND_URL' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
  2. GET BACKEND_URL/match/231 net::ERR_FAILED 403 (Forbidden)
  3. Uncaught (in promise) AxiosError {message: 'Network Error', name: 'AxiosError', code: 'ERR_NETWORK', config: {…}, request: XMLHttpRequest, …}

字符串
以下是我的 Spring 课程www.example.com:

  1. @Configuration
  2. @EnableWebSecurity
  3. public class SecurityConfig{
  4. @Bean
  5. public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
  6. http.authorizeRequests();
  7. CorsConfiguration cors = new CorsConfiguration();
  8. cors.setAllowedOrigins(List.of("FRONTEND_URL"));
  9. cors.setAllowedHeaders(List.of("*"));
  10. cors.setAllowCredentials(true);
  11. UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  12. source.registerCorsConfiguration("/**", cors);
  13. http.authorizeRequests().anyRequest().authenticated();
  14. http.csrf().disable();
  15. http.cors().disable();
  16. return http.build();
  17. }
  18. }


公司简介

  1. <modelVersion>4.0.0</modelVersion>
  2. <parent>
  3. <groupId>org.springframework.boot</groupId>
  4. <artifactId>spring-boot-starter-parent</artifactId>
  5. <version>3.2.0</version>
  6. <relativePath/>
  7. </parent>
  8. <groupId>com.example</groupId>
  9. <artifactId>MatchMaker_BE</artifactId>
  10. <version>0.0.1-SNAPSHOT</version>
  11. <name>MatchMaker_BE</name>
  12. <description>MatchMaker_BE</description>
  13. <properties>
  14. <java.version>21</java.version>
  15. </properties>
  16. <dependencies>
  17. <dependency>
  18. <groupId>org.springframework.boot</groupId>
  19. <artifactId>spring-boot-starter-thymeleaf</artifactId>
  20. </dependency>
  21. <dependency>
  22. <groupId>org.springframework.boot</groupId>
  23. <artifactId>spring-boot-starter-web</artifactId>
  24. </dependency>
  25. <dependency>
  26. <groupId>com.mysql</groupId>
  27. <artifactId>mysql-connector-j</artifactId>
  28. <scope>runtime</scope>
  29. </dependency>
  30. <dependency>
  31. <groupId>org.springframework.boot</groupId>
  32. <artifactId>spring-boot-starter-test</artifactId>
  33. <scope>test</scope>
  34. </dependency>
  35. <dependency>
  36. <groupId>org.springframework.boot</groupId>
  37. <artifactId>spring-boot-starter-security</artifactId>
  38. </dependency>
  39. <dependency>
  40. <groupId>org.springframework.security</groupId>
  41. <artifactId>spring-security-config</artifactId>
  42. <version>6.2.0</version>
  43. </dependency>
  44. <dependency>
  45. <groupId>org.springframework.boot</groupId>
  46. <artifactId>spring-boot-autoconfigure</artifactId>
  47. <version>3.2.0</version>
  48. </dependency>
  49. <dependency>
  50. <groupId>org.springframework.security</groupId>
  51. <artifactId>spring-security-oauth2-client</artifactId>
  52. <version>6.2.0</version>
  53. </dependency>
  54. </dependencies>
  55. <build>
  56. <plugins>
  57. <plugin>
  58. <groupId>org.springframework.boot</groupId>
  59. <artifactId>spring-boot-maven-plugin</artifactId>
  60. </plugin>
  61. </plugins>
  62. </build>
  63. </project>


我的Vue前端的BackendService.js

  1. import axios from "axios";
  2. const BACKEND_BASE_URL = "BACKEND_URL"
  3. //const accessToken = localStorage.getItem("userInfo");
  4. //const headers = {Authorization: "Bearer " + accessToken};
  5. class BackendService{
  6. getMatch(matchId){
  7. console.log("Übermittelt match ID: " + matchId);
  8. const requestURI = BACKEND_BASE_URL + "/match/" + matchId;
  9. console.log("Übermittelt an: " + requestURI);
  10. return axios.get(requestURI/*, {headers: headers}*/);
  11. }
  12. }
  13. export default new BackendService()


我还尝试使用另一个www.example.com类,但这并没有改变任何东西

  1. @Configuration
  2. @EnableWebMvc
  3. public class WebConfig implements WebMvcConfigurer {
  4. @Bean
  5. public CorsFilter corsFilter() {
  6. UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  7. CorsConfiguration config = new CorsConfiguration();
  8. // Erlaube Anfragen von allen Ursprüngen
  9. config.addAllowedOrigin("FRONTEND_URL");
  10. // Erlaube bestimmte HTTP-Methoden (GET, POST, etc.)
  11. config.addAllowedMethod("*");
  12. // Erlaube bestimmte HTTP-Header
  13. config.addAllowedHeader("*");
  14. source.registerCorsConfiguration("/**", config);
  15. return new CorsFilter(source);
  16. }
  17. }


我已经在我的SecurityConfig中尝试了不同的变体。我认为类WebSecurityConfigurerAdapter不适用于我的Java版本。
我也想过使用我从Google SDK获得的信息作为后端调用的头令牌,但我不知道如何在后端验证令牌时,我根本无法到达它。

hgtggwj0

hgtggwj01#

尝试添加FilterRegistrationBean bean而不是CorsFilter
@Bean FilterRegistrationBean customCorsFilter(){

  1. UrlBasedCorsConfigurationSource source =
  2. new UrlBasedCorsConfigurationSource();
  3. CorsConfiguration config = new CorsConfiguration();
  4. config.setAllowCredentials(false);
  5. config.addAllowedOrigin(this.allowedOrigins);
  6. config.addAllowedHeader("*");
  7. config.addAllowedMethod("*");
  8. source.registerCorsConfiguration("/**", config);
  9. FilterRegistrationBean<CorsFilter> bean =
  10. new FilterRegistrationBean<>(new CorsFilter(source));
  11. bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
  12. return bean;

字符串
}

展开查看全部
8gsdolmq

8gsdolmq2#

您必须禁用HTTP OPTIONS方法的身份验证(预检请求)。

  1. http
  2. .authorizeHttpRequests(authorize -> authorize
  3. .requestMatchers(mvc.pattern(HttpMethod.OPTIONS, "/**")).permitAll()
  4. .anyRequest().authenticated()
  5. )

字符串

相关问题