1.跨域問題說明：后端域名為A.abc.com，前端域名為B.abc.com。
2.后端設置一個cookie發送給前台，domain應該是setDomain（“abc.com”），而不是setDomain（“B.abc.com”）
3.另外，還要實現WebMvcConfigurerr配置加入Cors的跨域
@Configuration public class WebConfig implements WebMvcConfigurer { @Override public void addCorsMappings(CorsRegistry registry) { registry.addMapping("/**").allowedOrigins("*").allowedMethods("GET", "POST", "OPTIONS", "PUT") .allowedHeaders("Content-Type", "X-Requested-With", "accept", "Origin", "Access-Control-Request-Method", "Access-Control-Request-Headers") .exposedHeaders("Access-Control-Allow-Origin", "Access-Control-Allow-Credentials") .allowCredentials(true).maxAge(3600); } }
--------------------------------------------分割線2018-9-16--------------------------------
由於之前的項目要搬到springcloud上面，所有就有了zuul網關來管理所有的請求，之前cookie設置的請求頭Authoriaztion居然沒有被傳到前端。
涼涼……
設置網關層跨域問題都已經全部允許任何請求頭（下圖），但是還是前端訪問還是沒有Authoriaztion，各種問題都排查了，都沒有問題。。。大寫的迷惘！！！
后來啊，干脆把Authoriaztion名字給改了，直接改為token。
艹，居然可以了，前端能拿到token；改回Authoriaztion，沒有。。。
后來查了資料，才發現哦，zuul會默認過濾掉幾個敏感詞，沒錯，就是它：
/**
* List of sensitive headers that are not passed to downstream requests. Defaults to a
* "safe" set of headers that commonly contain user credentials. It's OK to remove
* those from the list if the downstream service is part of the same system as the
* proxy, so they are sharing authentication data. If using a physical URL outside
* your own domain, then generally it would be a bad idea to leak user credentials.
*/
private Set<String> sensitiveHeaders = new LinkedHashSet<>(
Arrays.asList("Cookie", "Set-Cookie", "Authorization"));
而我，剛好就中獎了！！！