springboot+shiro 跨域解決（OPTIONS）

 

攔截器判斷

攔截器截取到請求先進行判斷，如果是OPTIONS請求的話，則放行

import com.alibaba.fastjson.JSON;
import com.zp.demo.util.JwtHelperUtil;
import org.apache.commons.lang.StringUtils;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.authc.AuthenticationFilter;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.http.HttpStatus;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.io.PrintWriter;
import java.util.Map;

//需要認證的API被調用前執行的攔截器也叫過濾器
public class TokenFilter extends AuthenticationFilter {

    private final Logger logger = LoggerFactory.getLogger(TokenFilter.class);

    @Override
    protected boolean onAccessDenied(ServletRequest servletRequest, ServletResponse servletResponse) {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        try {
　　　　　　　//這幾句代碼是關鍵
            if ("OPTIONS".equals(request.getMethod())){
                response.setStatus(org.apache.http.HttpStatus.SC_NO_CONTENT);;
                logger.info("OPTIONS 放行");
                return true; }
            String token = getToken(servletRequest);
            //判斷token 是否為空
            if (StringUtils.isEmpty(token)) {
                this.printUnauthorized("401", (HttpServletResponse) servletResponse);
                return false;
            } else {//不為空判斷是否過期
                Map maps = (Map) JSON.parse(JwtHelperUtil.validateLogin(token));
                if (maps == null) {
                    logger.info("token過期返回403");
                    response.setStatus(403);//可以用response.getWriter()返回json或你想要的格式,同時設置header: Content-Type:text/json
                    return false;
                }
            }
        } catch (Exception e) {
            logger.error("空指針異常", e);
        }
        logger.info("token有效放行");
        return true;
    }
private String getToken(ServletRequest servletRequest) {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        String authorizationHeader = request.getHeader("Authorization");//獲取請求頭中的Authorization屬性
        //System.out.println(authorizationHeader);
        if (!StringUtils.isEmpty(authorizationHeader)) {
            return authorizationHeader.replace(" ", "");
        }
        return null;
    }

    private void printUnauthorized(String messageCode, HttpServletResponse response) {
        String content = String.format("{\"code\":\"%s\",\"msg\":\"%s\"}", messageCode, HttpStatus.UNAUTHORIZED.getReasonPhrase());
        response.setContentType("application/json;charset=UTF-8");
        response.setContentLength(content.length());
        response.setStatus(HttpStatus.UNAUTHORIZED.value());
        try {
            PrintWriter writer = response.getWriter();
            writer.write(content);
        } catch (IOException var5) {
            var5.printStackTrace();
        }

    }
}

配置跨越：

import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/*
配置跨越訪問
 */
@Component
public class AllowOriginFilter implements Filter {

    @SuppressWarnings("unused")
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) res;
        HttpServletRequest request = (HttpServletRequest) req;
        response.setHeader("Access-Control-Allow-Origin", "*"); // 設置允許所有跨域訪問
        response.setHeader("Access-Control-Allow-Methods", "POST,GET,PUT,OPTIONS,DELETE");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "Origin,X-Requested-With,Content-Type,Accept,Authorization,token");
        response.setHeader("Access-Control-Allow-Credentials", "true");
        chain.doFilter(req, res);
    }

    public void init(FilterConfig filterConfig) {
    }

    public void destroy() {
    }


}