跨域WebSocket认证错误：WebSocket连接问题如何修复？

你的当前CORS配置仅覆盖普通HTTP请求，WebSocket握手阶段需要额外的跨域处理，以下是具体修复步骤：

1. 调整允许的Origin（关键） #

如果WebSocket连接需要携带认证凭证（比如Cookie、Token），不能用*作为Access-Control-Allow-Origin的值，必须指定具体前端域名，多域名场景可动态验证后设置：

// 示例：指定单个允许的域名
response.addHeader("Access-Control-Allow-Origin", "http://your-frontend-domain.com");
// 动态验证并设置Origin的示例
String origin = request.getHeader("Origin");
if (isValidAllowedOrigin(origin)) { // 自行实现域名校验逻辑
    response.addHeader("Access-Control-Allow-Origin", origin);
}

2. 添加凭证允许头 #

开启跨域凭证支持，这是WebSocket带认证连接的必要配置：

response.addHeader("Access-Control-Allow-Credentials", "true");

同时前端WebSocket连接需开启对应配置（以JS为例）：

const socket = new WebSocket('ws://your-websocket-server.com/ws');
socket.withCredentials = true;

3. 更新允许的请求头 #

WebSocket握手请求会携带Upgrade、Connection等特殊头，需添加到允许列表：

response.addHeader("Access-Control-Allow-Headers", "origin, content-type, accept, x-requested-with, Upgrade, Connection, Sec-WebSocket-Key, Sec-WebSocket-Version");

4. 配置WebSocket服务端专属跨域规则 #

如果使用Spring WebSocket这类框架，仅靠普通Filter的CORS配置可能不够，需在WebSocket注册时明确跨域规则：

@Configuration
@EnableWebSocket
public class WebSocketConfig implements WebSocketConfigurer {
    @Override
    public void registerWebSocketHandlers(WebSocketHandlerRegistry registry) {
        registry.addHandler(yourWebSocketHandler(), "/ws")
                .setAllowedOrigins("http://your-frontend-domain.com")
                .withSockJS();
    }
}

5. 修正代码语法错误 #

你提供的代码最后一行HttpServletResponse response = (HttpServletResponse)不完整，Filter中需正确获取并处理response对象：

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    
    // 配置CORS头
    response.addHeader("Access-Control-Allow-Origin", "http://your-frontend-domain.com");
    response.addHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS"); // 加入OPTIONS预检请求
    response.addHeader("Access-Control-Allow-Headers", "origin, content-type, accept, x-requested-with, Upgrade, Connection, Sec-WebSocket-Key, Sec-WebSocket-Version");
    response.addHeader("Access-Control-Max-Age", "3600");
    response.addHeader("Access-Control-Allow-Credentials", "true");
    
    // 直接响应OPTIONS预检请求
    if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
        response.setStatus(HttpServletResponse.SC_OK);
        return;
    }
    
    chain.doFilter(req, res);
}

内容的提问来源于stack exchange，提问作者ashishV