Chrome浏览器突发Spring Boot+CORS跨域问题 原配置失效求助

问题根源分析 #

你的CORS过滤器代码存在响应头拼写错误，这是导致Chrome无法识别CORS头的核心原因：

• Access-control-Allow-Methods 中的control首字母应为大写，正确写法是 Access-Control-Allow-Methods
• 当前配置的Access-Control-Allow-Headers覆盖范围不足，无法满足Angular常见请求头需求，比如Content-Type、Authorization等

修正后的CORS过滤器代码 #

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class CORSFilter implements Filter {
    private final Logger logger = LoggerFactory.getLogger(this.getClass());

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;

        response.setCharacterEncoding("UTF-8");
        // 允许指定源跨域，若需支持多源可动态获取请求头Origin设置
        response.setHeader("Access-Control-Allow-Origin", "http://localhost:8100");
        // 修正拼写错误，确保头名称正确
        response.setHeader("Access-Control-Allow-Methods", "POST, PUT, GET, OPTIONS, DELETE");
        // 扩展允许的请求头，覆盖Angular常用场景
        response.setHeader("Access-Control-Allow-Headers", "x-requested-with, accept, Content-Type, Authorization");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Credentials", "true");

        // 处理OPTIONS预检请求：设置完头后直接返回，无需走后续过滤器链
        if (request.getMethod().equalsIgnoreCase("OPTIONS")) {
            response.setStatus(HttpServletResponse.SC_OK);
            return;
        }

        // 非OPTIONS请求继续执行后续逻辑
        try {
            chain.doFilter(req, res);
        } catch (Exception e) {
            logger.error(e.getMessage(), e);
        }
    }

    // 补充Filter接口的其他必要实现方法
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {}

    @Override
    public void destroy() {}
}

额外排查点 #

• Chrome浏览器缓存：清理浏览器缓存和Cookie，避免旧的CORS响应缓存干扰
• Spring Boot拦截器顺序：确保当前CORS过滤器的@Order(Ordered.HIGHEST_PRECEDENCE)生效，避免被其他拦截器（如权限拦截器）提前拦截请求，导致CORS头未被设置
• Angular请求配置：确认前端请求是否携带了自定义头，若有需确保已在Access-Control-Allow-Headers中添加对应项
• 协议一致性：若前端或后端近期切换了协议（比如从HTTP改HTTPS），需确保跨域源地址协议一致

内容的提问来源于stack exchange，提问作者Amit Kumar