在飞行前响应中，访问控制-允许标头不允许请求头字段x-xsrf-token。

Question

SprinBoot键盘遮挡器会被浏览器屏蔽，

在飞行前响应中，访问控制-允许标头不允许请求头字段x-xsrf-token。

从源'http://localhost:8080/auth/realms/test/protocol/openid-connect/token‘获取'http://localhost:8081’的访问已被CORS策略所阻止:请求标头字段x-xsrf-令牌不允许在飞行前响应中被访问控制-允许-标头。

This cors configs were added to spring boot app,
      cors: true
      cors-allowed-methods: GET,POST,HEAD,PUT,DELETE,OPTIONS
      cors-allowed-headers: x-xsrf-token

同时，客户端url http://localhost:8081也被添加到keeycloak中的Web中。不知道还缺什么让它起作用。

Answer 1

您可以使用CorsConfiguration设置允许的标头。

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

import java.util.Arrays;
import java.util.Collections;
import java.util.List;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().configurationSource(corsConfigurationSource());
    }

    CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        List<String> allowOrigins = Arrays.asList("*");
        configuration.setAllowedOrigins(allowOrigins);
        configuration.setAllowedMethods(Collections.singletonList("*"));
        configuration.setAllowedHeaders(Collections.singletonList("*"));
        configuration.setAllowCredentials(true);
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

Answer 2

您是否尝试过在控制器类和存储库类上使用@跨界源(origins=“http://localhost:8081")？

还有:尝试在您的主WebConfigurer应用程序类中添加SpringBoot Bean，并将其与@跨界起源(origins=“http://localhost:8081")连接起来。”

    @Bean
    public WebMvcConfigurer corsConfigurer() {
        return new WebMvcConfigurer() {
            @Override
            public void addCorsMappings(CorsRegistry registry) {
                System.out.println("here");
                registry.addMapping("/**").allowedOrigins("http://localhost:8081").allowedMethods("PUT", "DELETE" )
                .allowedHeaders("header1", "header2", "header3")
                .exposedHeaders("header1", "header2")
                .allowCredentials(false).maxAge(3600);;
            }
        };
    }

请访问此链接以获取在应用服务器端启用CORS。