SpringBoot与Angular集成遇CORS问题，配置后仍未解决求助

从源'http://localhost:4200'访问'http://localhost:8080/api/v1/public/auth/signup'的XMLHttpRequest被CORS策略阻止：预检请求的响应未通过访问控制检查：请求的资源上不存在'Access-Control-Allow-Origin'标头。

已配置CORS相关内容但问题仍未解决，当前Spring Security及CORS配置代码如下：

Spring Security配置 #

@Bean
public DefaultSecurityFilterChain securityWebFilterChain(HttpSecurity http) throws Exception {
    return http
            .csrf()
            .disable()
            .cors().configurationSource(corsConfigurationSource).and()
            .authorizeHttpRequests()
            .requestMatchers("/api/v1/public/**")
            .permitAll()
            .anyRequest()
            .authenticated()
            .and()
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .apply(securityJwtConfigurer)
            .and()
            .formLogin().disable()
            .build();
}

现有CORS配置Bean #

@Configuration
public class CorsConfig {
    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(List.of("http://localhost:4200"));
        configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
        configuration.setAllowedHeaders(List.of("Authorization"));
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

问题分析及修复方案 #

1. 预检请求头缺失：你的CORS配置仅允许Authorization请求头，但前端发起的预检请求（OPTIONS）可能携带Content-Type等其他必要头，导致预检不通过。需要补充允许的头，或直接放开所有必要头。
2. 方法覆盖不全：预检请求本身是OPTIONS方法，当前配置未明确允许该方法，需添加到允许列表。

修复后的CORS配置示例：

@Configuration
public class CorsConfig {
    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(List.of("http://localhost:4200"));
        // 明确包含预检请求的OPTIONS方法
        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
        // 允许前端常用请求头，可根据实际需求调整
        configuration.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type", "Accept"));
        // 若前端需要携带Cookie等凭证，需开启此配置
        configuration.setAllowCredentials(true);
        // 暴露前端需要读取的响应头（如自定义的Authorization）
        configuration.setExposedHeaders(List.of("Authorization"));
        
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

另外，可调整Spring Security配置中CORS的写法，确保配置生效优先级：

@Bean
public DefaultSecurityFilterChain securityWebFilterChain(HttpSecurity http) throws Exception {
    return http
            .csrf().disable()
            // 明确指定CORS配置源
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
            .authorizeHttpRequests(auth -> auth
                    .requestMatchers("/api/v1/public/**").permitAll()
                    .anyRequest().authenticated())
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .apply(securityJwtConfigurer)
            .and()
            .formLogin().disable()
            .build();
}

内容的提问来源于stack exchange，提问作者Don Fleym