Angular向Spring Boot发注册请求遇CORS拦截问题求助

问题原因 #

控制台错误明确指出：你的Angular请求中携带了domain自定义请求头，但Java端CORS过滤器配置的Access-Control-Allow-Headers列表里未包含该字段，导致预检（OPTIONS）请求被拒绝。

解决方案 #

方案1：修改现有Filter代码 #

直接在Access-Control-Allow-Headers中添加domain字段：

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        try {
            System.out.println("inside filter>>>>");
             HttpServletResponse response = (HttpServletResponse) res;
                HttpServletRequest request = (HttpServletRequest) req;
                response.setHeader("Access-Control-Allow-Origin", "http://localhost:4200");
                response.setHeader("Access-Control-Allow-Credentials", "true");
                response.setHeader("Access-Control-Allow-Methods",
                        "ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL");
                response.setHeader("Access-Control-Max-Age", "3600");
                // 添加domain字段到允许的请求头列表
                response.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, domain");

            chain.doFilter(request, response);
        }catch(Exception ex) {
            ex.printStackTrace();
        }
    }

方案2：使用Spring Boot官方CORS配置（更推荐） #

避免手动编写Filter容易出错的问题，采用Spring官方提供的规范配置方式：

方法A：控制器级注解配置

在注册接口所在的Controller上添加@CrossOrigin注解，精准控制该控制器的CORS规则：

@CrossOrigin(
    origins = "http://localhost:4200",
    allowedHeaders = {"Origin", "X-Requested-With", "Content-Type", "Accept", "Key", "Authorization", "domain"},
    allowCredentials = true,
    maxAge = 3600
)
@RestController
@RequestMapping("/bites/service")
public class SignupController {
    // 注册接口方法
    @PostMapping("/signup")
    public ResponseEntity<?> handleSignup(@RequestBody UserSignupRequest request) {
        // 业务逻辑实现
        return ResponseEntity.ok("注册成功");
    }
}

方法B：全局CORS配置

创建全局配置类，统一管理所有接口的CORS规则：

@Configuration
public class GlobalCorsConfig implements WebMvcConfigurer {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/bites/service/**") // 匹配你的接口路径
                .allowedOrigins("http://localhost:4200")
                .allowedMethods("*") // 允许所有HTTP方法，也可指定POST、OPTIONS等具体方法
                .allowedHeaders("Origin", "X-Requested-With", "Content-Type", "Accept", "Key", "Authorization", "domain")
                .allowCredentials(true)
                .maxAge(3600);
    }
}

验证修改 #

修改完成后，重启Spring Boot服务，再测试Angular的注册请求，CORS拦截问题即可解决。

内容的提问来源于stack exchange，提问作者Meta Stack