Spring Boot跨域问题：无法从其他源访问受保护资源

Hey there, I totally get how frustrating this CORS problem can be—spending days stuck on something that feels like it should just work. Let’s walk through the most common fixes for your scenario:

1. Verify Your Global RepositoryRestConfig CORS Setup #

First, double-check that your RepositoryRestConfiguration CORS mapping includes all the necessary settings. A common mistake is using allowedOrigins("*") instead of allowedOriginPatterns("*") (Spring Boot 2.4+ recommends this to avoid issues with credentialed requests). Here’s a complete example:

@Configuration
public class RepositoryRestConfig implements RepositoryRestConfigurer {
    @Override
    public void configureRepositoryRestConfiguration(RepositoryRestConfiguration config, CorsRegistry cors) {
        // Map all endpoints and configure CORS properly
        cors.addMapping("/**")
            .allowedOriginPatterns("*") // Replace with your frontend domain (e.g., "http://localhost:3000") for production
            .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
            .allowedHeaders("*")
            .allowCredentials(true) // Critical if your request includes cookies/auth tokens
            .maxAge(3600); // Cache preflight response to reduce OPTIONS requests
    }
}

2. Integrate CORS with Spring Security (If You’re Using It) #

If your app uses Spring Security, its filter chain runs before the CORS filter—so even if you have global CORS config, Security might block the request before the CORS headers are added. Fix this by explicitly enabling CORS in your Security config:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .cors() // This tells Security to use your global CORS config
            .and()
            .csrf().disable() // Disable CSRF if you’re doing a full frontend-backend separation (or configure it properly for your use case)
            .authorizeRequests()
            .antMatchers(HttpMethod.OPTIONS, "/**").permitAll() // Ensure OPTIONS preflight requests are allowed without auth
            .anyRequest().authenticated();
            // Add your other security rules here (e.g., OAuth2, form login)
    }
}

3. Check Frontend Request Settings #

If your frontend is sending credentialed requests (like cookies or auth tokens), you need to enable credentials in your HTTP client:

• Axios:

  axios.get('http://localhost:8080/greetings', { withCredentials: true });
  

• Fetch API:

  fetch('http://localhost:8080/greetings', {
    credentials: 'include'
  });
  

4. Validate Request Paths and Preflight Requests #

• Make sure your frontend is hitting the correct Spring Data REST endpoints (default is lowercase entity name + s, e.g., /greetings for your Greeting entity).
• Check your browser’s dev tools (Network tab) for the OPTIONS preflight request. If it’s failing with a 403, that’s a sign Security is blocking it—refer back to step 2 to allow OPTIONS requests.

5. Debug with Browser Console Errors #

The browser’s console will give you specific error messages (e.g., "No 'Access-Control-Allow-Origin' header is present on the requested resource" or "Credentials flag is true, but Access-Control-Allow-Origin is not '*'"). Use these messages to narrow down exactly which part of the CORS config is missing.

Start with these steps—most of the time, the issue is either a missing setting in the CORS mapping, a conflict with Spring Security, or a frontend request not sending credentials correctly.

内容的提问来源于stack exchange，提问作者st.