GWT-No 'Access-Control-Allow-Origin' header 出现在请求的资源上

Question

我们正在尝试在 tomcat 上实施 CORS 过滤器以允许跨域请求。我们在两台不同的 tomcat（不同的机器）上有两个 GWT 项目。在阅读了 CORS 过滤器文档CORS 之后，我刚刚在 tomcat 的 web.xml 文件中添加了 CORS 过滤器。

 `<filter>
  <filter-name>CorsFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
  <init-param>
    <param-name>cors.allowed.origins</param-name>
    <param-value>*</param-value>
  </init-param>
  <init-param>
    <param-name>cors.allowed.methods</param-name>
    <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
  </init-param>
  <init-param>
    <param-name>cors.allowed.headers</param-name>
    <param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value>
  </init-param>
  <init-param>
    <param-name>cors.exposed.headers</param-name>
    <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
  </init-param>
  <init-param>
    <param-name>cors.support.credentials</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>cors.preflight.maxage</param-name>
    <param-value>10</param-value>
  </init-param>
</filter>
<filter-mapping>
  <filter-name>CorsFilter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>`

但是它不起作用。我收到了另一个与之相关的堆栈问题，但有点困惑如何在 GWT 中实现过滤器？

StackQues

使用 GWT 实施 CORS 过滤器的实际过程是什么？

Answer 1

扩展 Filter 并在您的服务器端添加 class，如下所示：
注意：这只是一个简单的例子。如果您没有以正确的方式配置它，请告知自己安全风险...
检查 this article

的最后一部分

public class CORSFilter implements Filter {
    // For security reasons set this regex to an appropriate value
    // example: ".*example\.com"
    private static final String ALLOWED_DOMAINS_REGEXP = ".*";

    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
            FilterChain filterChain) throws IOException, ServletException {

        HttpServletRequest req = (HttpServletRequest) servletRequest;
        HttpServletResponse resp = (HttpServletResponse) servletResponse;

        String origin = req.getHeader("Origin");
        if (origin != null && origin.matches(ALLOWED_DOMAINS_REGEXP)) {
            resp.addHeader("Access-Control-Allow-Origin", origin);
            if ("options".equalsIgnoreCase(req.getMethod())) {
                resp.setHeader("Allow", "GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS");
                if (origin != null) {
                    String headers = req.getHeader("Access-Control-Request-Headers");
                    String method = req.getHeader("Access-Control-Request-Method");
                    resp.addHeader("Access-Control-Allow-Methods", method);
                    resp.addHeader("Access-Control-Allow-Headers", headers);
                    // optional, only needed if you want to allow cookies.
                    resp.addHeader("Access-Control-Allow-Credentials", "true");
                    resp.setContentType("text/x-gwt-rpc");
                }
                resp.getWriter().flush();
                return;
            }
        }

        // Fix ios6 caching post requests
        if ("post".equalsIgnoreCase(req.getMethod())) {
            resp.addHeader("Cache-Control", "no-cache");
        }

        if (filterChain != null) {
            filterChain.doFilter(req, resp);
        }
    }

    @Override
    public void destroy() {
    }

    @Override
    public void init(FilterConfig arg0) throws ServletException {
    }
}

不要忘记在 web.xml（在 WAR 文件中，而不是 tomcat web.xml）文件中添加 Filter。

<filter>
    <filter-name>corsFilter</filter-name>
    <filter-class><YourProjectPath>.CORSFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>corsFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

GWT-No 'Access-Control-Allow-Origin' header 出现在请求的资源上

GWT-No 'Access-Control-Allow-Origin' header is present on the requested resource

java

gwt

tomcat

cors