让 Sa-Token 成为你的跨域救星：3 种方法轻松搞定跨域问题！

2023-03-07 22:01:33

Sa-Token：解决跨域问题的灵丹妙药

什么是跨域问题？

跨域问题是在 Web 开发中常见的痛点，它限制了不同源的资源请求。当浏览器出于安全考虑，对跨域请求进行限制时，就会出现跨域问题。这会导致我们无法访问资源、返回错误代码等问题。

Sa-Token 的跨域解决方案

Sa-Token 是一个强大的 Java 安全框架，它为跨域问题提供了丰富的解决方案。你可以通过以下方式使用 Sa-Token 来轻松应对各种跨域场景：

1. 配置全局跨域过滤器

@WebFilter(filterName = "CorsFilter", urlPatterns = "/*")
public class CorsFilter implements Filter {
    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) res;
        HttpServletRequest request = (HttpServletRequest) req;
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization");
        response.setHeader("Access-Control-Allow-Credentials", "true");
        chain.doFilter(req, res);
    }
}

此过滤器将为所有请求添加跨域响应头，从而允许跨域访问。

2. 使用注解添加跨域支持

@RestController
@RequestMapping("/api")
public class ApiController {

    @PostMapping("/login")
    public R login(@RequestBody User user) {
        // 省略登录逻辑

        // 设置跨域响应头
        HttpServletResponse response = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getResponse();
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "POST");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization");
        response.setHeader("Access-Control-Allow-Credentials", "true");

        return R.ok().data(token);
    }
}

在需要跨域支持的接口上添加 @CrossOrigin 注解即可。

3. 使用拦截器添加跨域支持

@Component
public class CorsInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization");
        response.setHeader("Access-Control-Allow-Credentials", "true");
        return true;
    }
}