利用cors，實現js跨域訪問Tomcat下資源

第一步：頁面js代碼：

function createCORSRequest(method, url){
    var xhr = new XMLHttpRequest();
    if ("withCredentials" in xhr){
        xhr.open(method, url, true);
    } else if (typeof XDomainRequest != "undefined"){
        xhr = new XDomainRequest();
        xhr.open(method, url);
    } else {
        xhr = null;
    }
    return xhr;
}

var request = createCORSRequest("get", "http://192.168.5.221:8080/");
if (request){
    request.onreadystatechange = function(){
        if (request.readyState == 4 && request.status == 200) {
            var response = request.responseText;
            console.log(response)
        }   
    request.send();
}

第二步：在tomcat服務器下webapps/ROOT目錄下創建如下兩個xml文件
clientaccesspolicy.xml

<?xml version="1.0" encoding="utf-8" ?>
<access-policy>
  <cross-domain-access>
    <policy>  
      <allow-from http-request-headers="*">  
        <domain uri="*"/>  
      </allow-from>  
      <grant-to>  
        <resource path="/" include-subpaths="true"/>  
      </grant-to>  
    </policy>  
  </cross-domain-access>  
</access-policy>  

crossdomain.xml

<?xml version="1.0"?>  
  
<cross-domain-policy>  
  
<allow-access-from domain="*" />  
  
</cross-domain-policy>

第三步：在Tomcat服務器下conf/web.xml中，或者項目WEB-INF/web.xml中，我選擇的是在項目下配置過濾器。我驗證了兩個，一個是tomcat下自帶的cors過濾器，一個是cors-filter-1.7.jar下的過濾器。兩個我都測試了，沒問題。

應用tomcat的filter配置如下：參數cors.allowOrigin可以指定具體的源來訪問

<filter>
  <filter-name>CorsFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
  <init-param>
    <param-name>cors.allowed.origins</param-name>
    <param-value>*</param-value>
  </init-param>
  <init-param>
    <param-name>cors.allowed.methods</param-name>
    <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
  </init-param>
  <init-param>
    <param-name>cors.allowed.headers</param-name>
    <param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value>
  </init-param>
  <init-param>
    <param-name>cors.exposed.headers</param-name>
    <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
  </init-param>
  <init-param>
    <param-name>cors.support.credentials</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>cors.preflight.maxage</param-name>
    <param-value>10</param-value>
  </init-param>
</filter>
<filter-mapping>
  <filter-name>CorsFilter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

或者應用cors-filter-1.7.jar，還需要java-property-utils-1.9.jar，可以在http://mvnrepository.com/artifact/com.thetransactioncompany/cors-filter 選擇某個版本導入pom.xml中，自動導入jar包。

配置如下：參數cors.allowOrigin可以指定具體的源來訪問

<filter>
    <filter-name>CORS</filter-name>
    <filter-class>com.thetransactioncompany.cors.CORSFilter</filter-class>
    <init-param>
     <param-name>cors.allowOrigin</param-name>
        <param-value>*</param-value>
    </init-param>
    <init-param>
     <param-name>cors.supportedMethods</param-name>
        <param-value>GET, POST, HEAD, PUT, DELETE</param-value>
    </init-param>
    <init-param>
     <param-name>cors.supportedHeaders</param-name>
        <param-value>Accept, Origin, X-Requested-With, Content-Type, Last-Modified</param-value>
    </init-param>
    <init-param>
        <param-name>cors.exposedHeaders</param-name>
        <param-value>Set-Cookie</param-value>
    </init-param>
    <init-param>
        <param-name>cors.supportsCredentials</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>CORS</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

第一次寫博客，有什么不好的地方，歡迎指導！

參考文獻：

http://www.nczonline.net/blog/2010/05/25/cross-domain-ajax-with-cross-origin-resource-sharing/

http://tomcat.apache.org/tomcat-7.0-doc/config/filter.html#CORS_Filter

http://ibleave60.blog.51cto.com/2669415/1208652

http://blog.csdn.net/liumm0000/article/details/8443550