spring中解决CROS跨域请求的方案

Spring CORS配置实践

最新推荐文章于 2025-04-08 00:30:00 发布

原创最新推荐文章于 2025-04-08 00:30:00 发布 · 1.1k 阅读

0 ·

CC 4.0 BY-SA版权

Spring framework 专栏收录该内容

10 篇文章

订阅专栏

本文介绍如何使用Spring框架的@CrossOrigin注解轻松实现跨域资源共享（CORS）。通过示例展示了不同级别的CORS配置方法，包括方法级和控制器级别。

感觉spring真是个强大的框架，解决这种棘手的问题很简单，参考官方文档：

Controller method CORS configuration

You can add to your @RequestMapping annotated handler method a @CrossOriginannotation in order to enable CORS on it (by default @CrossOrigin allows all origins and the HTTP methods specified in the @RequestMapping annotation):

@RestController
@RequestMapping("/account")
public class AccountController {

	@CrossOrigin
	@GetMapping("/{id}")
	public Account retrieve(@PathVariable Long id) {
		// ...
	}

	@DeleteMapping("/{id}")
	public void remove(@PathVariable Long id) {
		// ...
	}
}

It is also possible to enable CORS for the whole controller:

@CrossOrigin(origins = "http://domain2.com", maxAge = 3600)
@RestController
@RequestMapping("/account")
public class AccountController {

	@GetMapping("/{id}")
	public Account retrieve(@PathVariable Long id) {
		// ...
	}

	@DeleteMapping("/{id}")
	public void remove(@PathVariable Long id) {
		// ...
	}
}

In this example CORS support is enabled for both retrieve() and remove() handler methods, and you can also see how you can customize the CORS configuration using @CrossOrigin attributes.

You can even use both controller and method level CORS configurations, Spring will then combine both annotation attributes to create a merged CORS configuration.

@CrossOrigin(maxAge = 3600)
@RestController
@RequestMapping("/account")
public class AccountController {

	@CrossOrigin(origins = "http://domain2.com")
	@GetMapping("/{id}")
	public Account retrieve(@PathVariable Long id) {
		// ...
	}

	@DeleteMapping("/{id}")
	public void remove(@PathVariable Long id) {
		// ...
	}
}