rest - 访问 https REST 端点时出现 CORS 问题

Question

我想使用 http://localhost:9080/StudentWeb/MyRest-rest/services/students/ 上提供的 REST 资源来 self 的 AngularJS 应用程序，并且 REST 应用程序使用以下部署描述符 (web.xml) 部署在 Websphere Appliation Server 中。应用程序在此配置下运行完美，用户具有 RegisteredUsers 角色。

 <?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    version="3.0">
    <display-name>MyRestApplicationServicesWeb</display-name>
    <servlet>
        <description>
            JAX-RS Tools Generated - Do not modify</description>
        <servlet-name>MyRestRest</servlet-name>
        <servlet-class>com.ibm.websphere.jaxrs.server.IBMRestServlet</servlet-class>
        <init-param>
            <param-name>javax.ws.rs.Application</param-name>
            <param-value>com.myrest.student.rest.StudentApplication</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
        <enabled>true</enabled>
        <async-supported>false</async-supported>
    </servlet>

    <servlet-mapping>
        <servlet-name>MyRestRest</servlet-name>
        <url-pattern>/MyRest-rest/*</url-pattern>
    </servlet-mapping>

    <security-role>
        <description>RegisteredUsers</description>
        <role-name>RegisteredUsers</role-name>
    </security-role>

    <security-constraint>
        <display-name>Area for authenticated users</display-name>
        <web-resource-collection>
            <web-resource-name>Protected Resources</web-resource-name>
            <url-pattern>/MyRest-rest/services/*</url-pattern>
            <http-method>GET</http-method>
        </web-resource-collection>
        <auth-constraint>
            <role-name>RegisteredUsers</role-name>
        </auth-constraint>
    </security-constraint>
    <filter>
        <filter-name>CORSFilter</filter-name>
        <filter-class>com.myrest.student.filter.StudentCORSFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>CORSFilter</filter-name>
        <url-pattern>/MyRest-rest/*</url-pattern>
    </filter-mapping>
</web-app>

我想通过添加将 REST API 转换为 https 来保护 AngularJS 应用程序和 WAS REST 端点之间的数据流。对于这一点，

<user-data-constraint>
    <description>Redirects http requests to https</description>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint> 

在安全约束标签中。

请找到添加的 CORS 过滤器，

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {

        System.out.println("Inside Filter");

        ((HttpServletResponse) response).addHeader("Access-Control-Allow-Origin", "*");
        ((HttpServletResponse) response).addHeader("Access-Control-Allow-Credentials", "true");
        ((HttpServletResponse) response).addHeader("Access-Control-Allow-Method", "GET, POST, PUT, DELETE, OPTIONS");
        ((HttpServletResponse) response).addHeader("Content-Type", "application/json");
        ((HttpServletResponse) response).addHeader("Access-Control-Allow-Headers", "Content-Type");

        String accessControlReqHeader = ((HttpServletRequest) request).getHeader("Access-Control-Request-Headers");
        System.out.println(accessControlReqHeader);

        if (((HttpServletRequest) request).getMethod().equalsIgnoreCase("OPTIONS")) {
            ((HttpServletResponse) response).addHeader("Access-Control-Allow-Headers", accessControlReqHeader);
        } else {
            chain.doFilter(request, response);
        }
    }

但是现在 AngularJS 应用程序出现错误，如下所示，

XMLHttpRequest cannot load http://localhost:9080/StudentWeb/MyRest-rest/services/students/12341234. The request was redirected to 'https://localhost:9443/StudentWeb/MyRest-rest/services/students/12341234', which is disallowed for cross-origin requests that require preflight.

我可以将此视为 https 的 CORS 问题。我该如何解决这个问题。

Answer 1

这是您的问题，或者至少是其中一个问题。

((HttpServletResponse) 响应).addHeader("Access-Control-Allow-Origin", "*");

通过 CORS 请求发送凭据时不能使用通配符。相反，明确列出来源。如果您有很多，请检查客户端的原始 header ，如果您的服务器决定向该客户端提供内容，则将请求原始 header 的内容作为 Access-Control-Allow-Origin 响应 header 的值返回。