Playframework 2.7.X自定义CORSFilter支持泛域名跨域实现示例咨询

方式一：直接通过配置文件实现（简单场景适用） #

如果仅需要基础的通配子域名匹配，直接在conf/application.conf中添加如下配置即可：

play.filters.cors {
  allowedOrigins = ["http://*.o1test.com", "https://*.o1test.com"]
  allowedHttpMethods = ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
  allowedHttpHeaders = ["Accept", "Content-Type", "Authorization"]
  supportsCredentials = true
  preflightMaxAge = 1 hour
  # 启用CORS过滤器
  enabled = true
}

配置完成后将CORS Filter加入全局过滤器列表即可生效。

方式二：自定义代码实现（灵活场景适用） #

如果需要更复杂的域名判断逻辑（比如同时支持根域名、多泛域名等），可以通过自定义CORS配置断言实现：

Scala 实现样例 #

如果你使用Scala栈，通过继承HttpFiltersComponents重写CORS配置即可：

import play.api.ApplicationLoader
import play.api.BuiltInComponentsFromContext
import play.api.filters.HttpFiltersComponents
import play.filters.cors.CorsComponents
import play.filters.cors.CorsConfig

class CustomApplicationLoader extends ApplicationLoader {
  override def load(context: ApplicationLoader.Context) = {
    new BuiltInComponentsFromContext(context) with HttpFiltersComponents with CorsComponents {
      // 自定义域名匹配规则，支持所有o1test.com子域名
      override lazy val corsConfig: CorsConfig = CorsConfig(
        allowedOrigins = CorsConfig.OriginsPredicate { origin =>
          // 匹配所有以.o1test.com结尾的域名，同时兼容http/https协议
          origin.endsWith(".o1test.com")
          // 如果需要同时支持根域名o1test.com可以加上下面这行
          // || origin == "https://o1test.com" || origin == "http://o1test.com"
        },
        allowedHttpMethods = Set("GET", "POST", "PUT", "DELETE", "OPTIONS"),
        allowedHttpHeaders = Set("Accept", "Content-Type", "Authorization"),
        supportsCredentials = true,
        preflightMaxAge = 3600
      )

      // 你的路由配置
      override lazy val router = Router.empty // 替换为你实际的路由实例
    }.application
  }
}

配置完成后在conf/application.conf中指定自定义加载器：

play.application.loader = com.your.project.package.CustomApplicationLoader

Java 实现样例 #

如果你使用Java栈，通过自定义过滤器和CORS配置Provider实现：

import play.filters.cors.CORSConfig;
import play.filters.cors.CORSFilter;
import play.http.DefaultHttpFilters;
import javax.inject.Inject;
import javax.inject.Provider;
import java.util.Arrays;
import java.util.function.Predicate;

public class CustomHttpFilters extends DefaultHttpFilters {
    @Inject
    public CustomHttpFilters(CORSFilter corsFilter) {
        super(corsFilter);
    }

    // 自定义CORS配置提供类
    public static class CustomCORSConfigProvider implements Provider<CORSConfig> {
        @Override
        public CORSConfig get() {
            Predicate<String> originCheck = origin -> 
                origin.endsWith(".o1test.com");
                // 需要支持根域名可追加：|| origin.equals("https://o1test.com") || origin.equals("http://o1test.com")

            return new CORSConfig(
                CORSConfig.allowedOrigins(originCheck),
                Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"),
                Arrays.asList("Accept", "Content-Type", "Authorization"),
                Arrays.asList("*"),
                true,
                3600,
                false
            );
        }
    }
}

配置完成后在conf/application.conf中添加绑定规则：

play.http.filters = com.your.project.package.CustomHttpFilters
play.modules.enabled += play.filters.cors.CORSModule
bind(play.filters.cors.CORSConfig.class).toProvider(com.your.project.package.CustomHttpFilters.CustomCORSConfigProvider.class)

注意事项 #

• 若你的接口需要支持跨域传Cookie等凭证，必须将supportsCredentials设为true，此时不能直接用*作为允许域名，必须用上述域名匹配的方式实现
• 生产环境建议按需限制allowedHttpMethods和allowedHttpHeaders范围，不要放开不必要的权限

内容的提问来源于stack exchange，提问作者Parveen