tomcat - 显示配置了 CORS 的 Web 服务器的允许来源

Question

我正在尝试了解 cors 的工作原理。如果我使用未在我的 web.xml cors 配置中配置的来源，则 tomat cors 过滤器会抛出 403 状态。有效的 cors 响应如下所示:

$ curl -H "Origin: http://test.de" -H "Access-Control-Request-Method: POST" -H "Access-Control-Request-Headers: X-Requested-With" -X OPTIONS --verbose http://localhost:8080/static
/
* Adding handle: conn: 0x20830d8
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x20830d8) send_pipe: 1, recv_pipe: 0
* About to connect() to localhost port 8080 (#0)
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> OPTIONS /static/ HTTP/1.1
> User-Agent: curl/7.30.0
> Host: localhost:8080
> Accept: */*
> Origin: http://test.de
> Access-Control-Request-Method: POST
> Access-Control-Request-Headers: X-Requested-With
>
< HTTP/1.1 200 OK
* Server Apache-Coyote/1.1 is not blacklisted
< Server: Apache-Coyote/1.1
< Access-Control-Allow-Origin: http://test.de
< Access-Control-Allow-Credentials: true
< Access-Control-Max-Age: 1800
< Access-Control-Allow-Methods: POST
< Access-Control-Allow-Headers: content-type,access-control-request-headers,access-control-request-method,accept,origin,x-requested-with
< Content-Length: 0
< Date: Fri, 27 Mar 2015 09:55:38 GMT
<
* Connection #0 to host localhost left intact

无效的 cors 响应如下所示:

$ curl -H "Origin: http://test2.de" -H "Access-Control-Request-Method: POST" -H "Access-Control-Request-Headers: X-Requested-With" -X OPTIONS --verbose http://localhost:8080/stati
c/
* Adding handle: conn: 0x8a30d8
* Adding handle: send: 0
* Adding handle: recv: 0
* Curl_addHandleToPipeline: length: 1
* - Conn 0 (0x8a30d8) send_pipe: 1, recv_pipe: 0
* About to connect() to localhost port 8080 (#0)
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> OPTIONS /static/ HTTP/1.1
> User-Agent: curl/7.30.0
> Host: localhost:8080
> Accept: */*
> Origin: http://test2.de
> Access-Control-Request-Method: POST
> Access-Control-Request-Headers: X-Requested-With
>
< HTTP/1.1 403 Forbidden
* Server Apache-Coyote/1.1 is not blacklisted
< Server: Apache-Coyote/1.1
< Content-Type: text/plain
< Content-Length: 0
< Date: Fri, 27 Mar 2015 10:04:09 GMT
<
* Connection #0 to host localhost left intact

我还以为会有访问控制允许来源:http://test.de403 响应中的一部分？有什么办法可以找出 url 的允许来源吗？或者这是想要的行为？ jetty cors 实现的工作方式是否与 tomcat 相同？

至少，我有点困惑，tomcat cors 过滤器只查看原始 header 。如果我不添加任何原始 header ，请求将以响应状态代码 200 进行处理，我将获得全部内容。

换句话说，同源策略只是浏览器的问题，每个请求都发送源？

啊，还有最后一个问题，预检请求是“可选”请求吗？如果我使用 curl 在没有预检请求的情况下发出 cors 请求，我也会收到 200 响应。正确吗？

Answer 1

我的第一步去了官方Tomcat CORS Filter文档。在那里我注意到两件事:

1. Tomcat CORS Filter FlowChart
2. Tomcat CORS 过滤器类名:org.apache.catalina.filters.CorsFilter

首先，我检查了 Tomcat CORS Filter FlowChart并执行大量 CURL 请求以找到解决“问题”的方法。没有进展。

其次，我检查了Tomcat CORS Filter类源代码-> GrepCode.com: org.apache.catalina.filters.CorsFilter .在那里我注意到 HTTP POST 请求以某种方式需要填充 Content-Type HTTP header 。所以我只是将它设置为 text/plain。然后 Tomcat 服务器应用程序开始正确返回 HTTP CORS header 以及 HTTP 403(禁止访问)和 HTTP 200(正常)返回状态。

例子:

$ curl -v -c c.txt -b c.txt -H "Origin: http://example.com" -H "Content-Type: text/plain" -X POST http://some-server.com:8080/trunk/rest/some/thing

HTTP请求:

POST /trunk/rest/some/thing HTTP/1.1
User-Agent: curl/7.35.0
Host: some-server.com:8080
Accept: */*
Cookie: JSESSIONID=SOMEID
Origin: http://example.com
Content-Type: text/plain

HTTP 响应:

< HTTP/1.1 200 OK
* Server Apache-Coyote/1.1 is not blacklisted
< Server: Apache-Coyote/1.1
< Access-Control-Allow-Origin: http://example.com
< Access-Control-Allow-Credentials: true
< Access-Control-Expose-Headers: Set-Cookie,X-JSessionId
< Content-Length: 0
< Date: Wed, 22 Apr 2015 08:04:49 GMT

据说 org.apache.catalina.filters.CorsFilter 类是根据 W3C CORS 实现的规范。也许问题的真正答案就藏在其中。

希望这对某人有帮助...