azure - 应用程序在一段时间后显示 CORS 错误 (AZURE AD)

Question

我正在使用 Spring Boot + Azure AD + angular9 并使用 azure ad 默认提供的 api 来访问我的应用程序。启动应用程序后，出现 Microsoft 登录 -> 验证信用 -> 显示我的登陆页面。所有 api 都工作正常。但过了一段时间(大约 5-6 分钟)后，所有 api 都开始失败。它在浏览器控制台中显示CORS ERROR。

Access to XMLHttpRequest at 'https://login.microsoftonline.com/common/oauth2/authorize?response_type=code
&client_id=<client_id>
&scope=openid%20https://graph.microsoft.com/user.read&state=lZfrMwK0nx5kQDjO56DJsMTFhcuvDmU5o0-ZCvTPvI4%3D
&redirect_uri=https://{abc}.com/login/oauth2/code/azure&nonce=CCGwfpb4klAiPtEApCs3nS8ICod0-htdHWvBATNYfXs' 
  (redirected from 'https://{abc}.com/api/supplier/add') from origin
 'https://{abc}.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: 
No 'Access-Control-Allow-Origin' header is present on the requested resource.

对于每个 api，它都会显示 CORSS 错误

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://login.microsoftonline.com/common/oauth2/authorize?
response_type=code&client_id=<client_id>
&scope=openid%20https://graph.microsoft.com/user.read
&state=LAJfYfn9XFOISAHO4Cq4iA5_Dkya3CFDXKgQmQVfpxg%3D
&redirect_uri=https://{abc}.com/login/oauth2/code/azure
&nonce=IBF8nVnrWhH-SY9VpNxouZcxn_6JZEo3J_d-JBHTAK4. 
(Reason: CORS header ‘Access-Control-Allow-Origin’ missing)

这是我的网络安全配置

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Value("${logout.url}")
    String logoutUrl;
    
    @Value("${redirect.url}")
    String redirectUrl;
    
    @Autowired
    private OAuth2UserService<OidcUserRequest, OidcUser> oidcUserService;
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        
        String logoffUrl = logoutUrl+"?post_logout_redirect_uri="+URLEncoder.encode(redirectUrl, "UTF-8");
        
         http
         .csrf().disable()
             .authorizeRequests()
             .anyRequest().authenticated()
             .and()
             .oauth2Login()
             .userInfoEndpoint()
             .oidcUserService(oidcUserService);
         
         http.logout().logoutUrl("/api/logout")
            .invalidateHttpSession(true)
            .deleteCookies("JSESSIONID")
            .logoutSuccessUrl(logoffUrl) ;
    }

}

WebMvcConfig

@Configuration
public class WebMvcConfig implements WebMvcConfigurer{
    
    @Value("${spring.allowed.origin}")
    public String allowedOrigin;

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
            .allowedOrigins(allowedOrigin)
            .allowedMethods("GET", "POST")
            .allowCredentials(true)
            .maxAge(3600);
    }
    
    
    @Override
    public void configurePathMatch(PathMatchConfigurer configurer) {
        UrlPathHelper urlPathHelper = new UrlPathHelper();
        urlPathHelper.setUrlDecode(false);
        configurer.setUrlPathHelper(urlPathHelper);
    }
}

从有角度的一侧，我发送如下所示的 header

headers = new HttpHeaders({
    'Content-Type': 'application/json',
    'Access-Control-Allow-Origin' : '*',
    'Access-Control-Allow-Credentials': 'true',
  });

请帮忙..谢谢

Answer 1

我使用 Angular msal 服务实现了 SPA。我使用loginPopUp方法来获取微软提供的登录弹出窗口。它还解决了我的 ADFS 安全问题。在这里，我没有使用任何 accessTokenSilent/accessTokenRedirect 方法在上一个 token 过期后获取访问 token 。我在 nginx.conf 文件(Web 服务器配置文件)中添加了 CSP header ，因此在 token 过期后，它会在单击任何 api 时自动为我提供新的访问 token 。

在 nginx.conf 文件中添加 CSP header

add_header Content-Security-Policy "frame-ancestors 'self';"  always;