Spring-MVC 跨域

CrossOrigin 注解

  • 通过注解设置跨域 demo 如下
  1. package com.huifer.source.controller;
  3. import org.springframework.web.bind.annotation.*;
  5. import java.util.HashMap;
  7. @CrossOrigin(maxAge = 3600)
  8. @RequestMapping("/")
  9. @RestController
  10. public class JSONController {
  11.     @ResponseBody
  12.     @GetMapping(value = "/json")
  13.     public Object ob() {
  14.         HashMap<String, String> hashMap = new HashMap<>();
  15.         hashMap.put("1", "a");
  16.         return hashMap;
  17.     }
  18. }

  • 切入点:

    • org.springframework.web.servlet.handler.AbstractHandlerMethodMapping#registerHandlerMethod

      • org.springframework.web.servlet.handler.AbstractHandlerMethodMapping.MappingRegistry#register方法
      1.         /**
      2.          * 注册方法 将controller 相关信息存储
      3.          *
      4.          * @param mapping 请求地址
      5.          * @param handler 处理类
      6.          * @param method  函数
      7.          */
      8.         public void register(T mapping, Object handler, Method method) {
      9.             // 上锁
      10.             this.readWriteLock.writeLock().lock();
      11.             try {
      12.                 // 创建 HandlerMethod , 通过 handler 创建处理的对象(controller)
      13.                 HandlerMethod handlerMethod = createHandlerMethod(handler, method);
      14.                 assertUniqueMethodMapping(handlerMethod, mapping);
      15.                 // 设置值
      16.                 this.mappingLookup.put(mapping, handlerMethod);
      18.                 // 获取url
      19.                 List<String> directUrls = getDirectUrls(mapping);
      20.                 for (String url : directUrls) {
      21.                     // 设置
      22.                     this.urlLookup.add(url, mapping);
      23.                 }
      25.                 String name = null;
      26.                 if (getNamingStrategy() != null) {
      27.                     name = getNamingStrategy().getName(handlerMethod, mapping);
      28.                     addMappingName(name, handlerMethod);
      29.                 }
      31.                 /**
      32.                  * 跨域设置
      33.                  * {@link org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping#initCorsConfiguration(Object, Method, RequestMappingInfo)}
      34.                  **/
      35.                 CorsConfiguration corsConfig = initCorsConfiguration(handler, method, mapping);
      36.                 if (corsConfig != null) {
      37.                     this.corsLookup.put(handlerMethod, corsConfig);
      38.                 }
      40.                 this.registry.put(mapping, new MappingRegistration<>(mapping, handlerMethod, directUrls, name));
      41.             }
      42.             finally {
      43.                 // 开锁
      44.                 this.readWriteLock.writeLock().unlock();
      45.             }
      46.         }

  • 着重查看CorsConfiguration初始化方法

    • org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping#initCorsConfiguration
  1. @Override
  2.     protected CorsConfiguration initCorsConfiguration(Object handler, Method method, RequestMappingInfo mappingInfo) {
  3.         // 重新创建,为什么不作为参数传递: 还有别的实现方法
  4.         HandlerMethod handlerMethod = createHandlerMethod(handler, method);
  5.         // 获取bean
  6.         Class<?> beanType = handlerMethod.getBeanType();
  8.         // 获取注解信息
  9.         CrossOrigin typeAnnotation = AnnotatedElementUtils.findMergedAnnotation(beanType, CrossOrigin.class);
  10.         CrossOrigin methodAnnotation = AnnotatedElementUtils.findMergedAnnotation(method, CrossOrigin.class);
  12.         if (typeAnnotation == null && methodAnnotation == null) {
  13.             return null;
  14.         }
  16.         CorsConfiguration config = new CorsConfiguration();
  17.         // 更新跨域信息
  18.         updateCorsConfig(config, typeAnnotation);
  19.         updateCorsConfig(config, methodAnnotation);
  21.         if (CollectionUtils.isEmpty(config.getAllowedMethods())) {
  22.             for (RequestMethod allowedMethod : mappingInfo.getMethodsCondition().getMethods()) {
  23.                 config.addAllowedMethod(allowedMethod.name());
  24.             }
  25.         }
  26.         // 返回跨域配置默认值
  27.         return config.applyPermitDefaultValues();
  28.     }

信息截图:

image-20200123085741347

image-20200123085756168

updateCorsConfig

  • 该方法对原有的配置信息做补充
  1.     private void updateCorsConfig(CorsConfiguration config, @Nullable CrossOrigin annotation) {
  2.         if (annotation == null) {
  3.             return;
  4.         }
  5.         for (String origin : annotation.origins()) {
  6.             config.addAllowedOrigin(resolveCorsAnnotationValue(origin));
  7.         }
  8.         for (RequestMethod method : annotation.methods()) {
  9.             config.addAllowedMethod(method.name());
  10.         }
  11.         for (String header : annotation.allowedHeaders()) {
  12.             config.addAllowedHeader(resolveCorsAnnotationValue(header));
  13.         }
  14.         for (String header : annotation.exposedHeaders()) {
  15.             config.addExposedHeader(resolveCorsAnnotationValue(header));
  16.         }
  18.         String allowCredentials = resolveCorsAnnotationValue(annotation.allowCredentials());
  19.         if ("true".equalsIgnoreCase(allowCredentials)) {
  20.             config.setAllowCredentials(true);
  21.         }
  22.         else if ("false".equalsIgnoreCase(allowCredentials)) {
  23.             config.setAllowCredentials(false);
  24.         }
  25.         else if (!allowCredentials.isEmpty()) {
  26.             throw new IllegalStateException("@CrossOrigin's allowCredentials value must be \"true\", \"false\", " +
  27.                     "or an empty string (\"\"): current value is [" + allowCredentials + "]");
  28.         }
  30.         if (annotation.maxAge() >= 0 && config.getMaxAge() == null) {
  31.             config.setMaxAge(annotation.maxAge());
  32.         }
  33.     }

最终解析结果

image-20200123085946476

  • 解析完成后放入 corsLookup对象中 类:org.springframework.web.servlet.handler.AbstractHandlerMethodMapping

    1.                 if (corsConfig != null) {
    2.                     this.corsLookup.put(handlerMethod, corsConfig);
    3.                 }

xml 配置方式

  1.     <mvc:cors>
  2.         <mvc:mapping path="/**"
  3.                      allowed-origins="http://domain1.com, http://domain2.com"
  4.                      allowed-methods="GET, PUT"
  5.                      allowed-headers="header1, header2, header3"
  6.                      exposed-headers="header1, header2" allow-credentials="false"
  7.                      max-age="3600" />
  9.         <mvc:mapping path="/**"
  10.                      allowed-origins="http://domain1.com" />
  11.     </mvc:cors>

  • mvc标签解析类: org.springframework.web.servlet.config.MvcNamespaceHandler，这个类对 Spring 配置文件中的<mvc:xxx>标签做了解析设定，如这次我们的关注点CORS

    1. public class MvcNamespaceHandler extends NamespaceHandlerSupport {
    3.     /**
    4.      * 初始化一些SpringMvc 的解析类
    5.      */
    6.     @Override
    7.     public void init() {
    8.         // 注解驱动
    9.         registerBeanDefinitionParser("annotation-driven", new AnnotationDrivenBeanDefinitionParser());
    10.         // 默认的 servlet 处理器
    11.         registerBeanDefinitionParser("default-servlet-handler", new DefaultServletHandlerBeanDefinitionParser());
    12.         // 拦截器
    13.         registerBeanDefinitionParser("interceptors", new InterceptorsBeanDefinitionParser());
    14.         // 资源
    15.         registerBeanDefinitionParser("resources", new ResourcesBeanDefinitionParser());
    16.         // 视图控制器
    17.         registerBeanDefinitionParser("view-controller", new ViewControllerBeanDefinitionParser());
    18.         // 重定向视图控制器
    19.         registerBeanDefinitionParser("redirect-view-controller", new ViewControllerBeanDefinitionParser());
    20.         registerBeanDefinitionParser("status-controller", new ViewControllerBeanDefinitionParser());
    21.         // 视图解析器
    22.         registerBeanDefinitionParser("view-resolvers", new ViewResolversBeanDefinitionParser());
    23.         // tiles 处理器
    24.         registerBeanDefinitionParser("tiles-configurer", new TilesConfigurerBeanDefinitionParser());
    26.         registerBeanDefinitionParser("freemarker-configurer", new FreeMarkerConfigurerBeanDefinitionParser());
    27.         registerBeanDefinitionParser("groovy-configurer", new GroovyMarkupConfigurerBeanDefinitionParser());
    29.         registerBeanDefinitionParser("script-template-configurer", new ScriptTemplateConfigurerBeanDefinitionParser());
    30.         // 跨域处理
    31.         registerBeanDefinitionParser("cors", new CorsBeanDefinitionParser());
    32.     }
    34. }

CorsBeanDefinitionParser

类图

image-20200123090442409

解析

  • 实现BeanDefinitionParser 接口的都有一个parse方法直接看方法.
    • 通过查看我们可以知道最终目的获取 xml 标签中的属性,对 CorsConfiguration进行初始化，最后 Spring 中注册
  1. public class CorsBeanDefinitionParser implements BeanDefinitionParser {
  3.     @Override
  4.     @Nullable
  5.     public BeanDefinition parse(Element element, ParserContext parserContext) {
  7.         Map<String, CorsConfiguration> corsConfigurations = new LinkedHashMap<>();
  8.         List<Element> mappings = DomUtils.getChildElementsByTagName(element, "mapping");
  10.         if (mappings.isEmpty()) {
  11.             // 最简配置
  12.             CorsConfiguration config = new CorsConfiguration().applyPermitDefaultValues();
  13.             corsConfigurations.put("/**", config);
  14.         }
  15.         else {
  16.             // 单个 mapping 处理
  17.             // mvc:mapping 标签
  18.             for (Element mapping : mappings) {
  19.                 // 跨域配置
  20.                 CorsConfiguration config = new CorsConfiguration();
  21.                 // 处理每个属性值,并且赋值
  22.                 if (mapping.hasAttribute("allowed-origins")) {
  23.                     String[] allowedOrigins = StringUtils.tokenizeToStringArray(mapping.getAttribute("allowed-origins"), ",");
  24.                     config.setAllowedOrigins(Arrays.asList(allowedOrigins));
  25.                 }
  26.                 if (mapping.hasAttribute("allowed-methods")) {
  27.                     String[] allowedMethods = StringUtils.tokenizeToStringArray(mapping.getAttribute("allowed-methods"), ",");
  28.                     config.setAllowedMethods(Arrays.asList(allowedMethods));
  29.                 }
  30.                 if (mapping.hasAttribute("allowed-headers")) {
  31.                     String[] allowedHeaders = StringUtils.tokenizeToStringArray(mapping.getAttribute("allowed-headers"), ",");
  32.                     config.setAllowedHeaders(Arrays.asList(allowedHeaders));
  33.                 }
  34.                 if (mapping.hasAttribute("exposed-headers")) {
  35.                     String[] exposedHeaders = StringUtils.tokenizeToStringArray(mapping.getAttribute("exposed-headers"), ",");
  36.                     config.setExposedHeaders(Arrays.asList(exposedHeaders));
  37.                 }
  38.                 if (mapping.hasAttribute("allow-credentials")) {
  39.                     config.setAllowCredentials(Boolean.parseBoolean(mapping.getAttribute("allow-credentials")));
  40.                 }
  41.                 if (mapping.hasAttribute("max-age")) {
  42.                     config.setMaxAge(Long.parseLong(mapping.getAttribute("max-age")));
  43.                 }
  44.                 corsConfigurations.put(mapping.getAttribute("path"), config.applyPermitDefaultValues());
  45.             }
  46.         }
  48.         // 注册到 Spring
  49.         MvcNamespaceUtils.registerCorsConfigurations(
  50.                 corsConfigurations, parserContext, parserContext.extractSource(element));
  51.         return null;
  52.     }
  54. }

  • 属性截图

    image-20200123090851644

    • 可以看出这个是我们的第一个跨域配置的信息

  • 注册方法

    1.     public static RuntimeBeanReference registerCorsConfigurations(
    2.             @Nullable Map<String, CorsConfiguration> corsConfigurations,
    3.             ParserContext context, @Nullable Object source) {
    4.         // 判断是否包含跨域bean(beanName:mvcCorsConfigurations)
    5.         if (!context.getRegistry().containsBeanDefinition(CORS_CONFIGURATION_BEAN_NAME)) {
    6.             RootBeanDefinition corsDef = new RootBeanDefinition(LinkedHashMap.class);
    7.             corsDef.setSource(source);
    8.             corsDef.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
    9.             if (corsConfigurations != null) {
    10.                 corsDef.getConstructorArgumentValues().addIndexedArgumentValue(0, corsConfigurations);
    11.             }
    12.             context.getReaderContext().getRegistry().registerBeanDefinition(CORS_CONFIGURATION_BEAN_NAME, corsDef);
    13.             // 注册组件,并且通知监听器
    14.             context.registerComponent(new BeanComponentDefinition(corsDef, CORS_CONFIGURATION_BEAN_NAME));
    15.         }
    16.         else if (corsConfigurations != null) {
    17.             // 注册bean
    18.             BeanDefinition corsDef = context.getRegistry().getBeanDefinition(CORS_CONFIGURATION_BEAN_NAME);
    19.             corsDef.getConstructorArgumentValues().addIndexedArgumentValue(0, corsConfigurations);
    20.         }
    21.         return new RuntimeBeanReference(CORS_CONFIGURATION_BEAN_NAME);
    22.     }

  • image-20200123091445694

CorsConfiguration

  • 跨域信息
  1.   /**
  2.      * 允许请求源
  3.      */
  4.     @Nullable
  5.     private List<String> allowedOrigins;
  7.     /**
  8.      * 允许的http方法
  9.      */
  10.     @Nullable
  11.     private List<String> allowedMethods;
  13.     /**
  14.      *
  15.      */
  16.     @Nullable
  17.     private List<HttpMethod> resolvedMethods = DEFAULT_METHODS;
  19.     /**
  20.      * 允许的请求头
  21.      */
  22.     @Nullable
  23.     private List<String> allowedHeaders;
  25.     /**
  26.      * 返回的响应头
  27.      */
  28.     @Nullable
  29.     private List<String> exposedHeaders;
  31.     /**
  32.      * 是否允许携带 cookies
  33.      */
  34.     @Nullable
  35.     private Boolean allowCredentials;
  37.     /**
  38.      * 存货有效期
  39.      */
  40.     @Nullable
  41.     private Long maxAge;

处理请求

  • 请求处理的一部分，前置后置都还有其他处理，这里只对跨域请求进行说明

    1.     @Override
    2.     @Nullable
    3.     public final HandlerExecutionChain getHandler(HttpServletRequest request) throws Exception {
    4.         Object handler = getHandlerInternal(request);
    5.         if (handler == null) {
    6.             handler = getDefaultHandler();
    7.         }
    8.         if (handler == null) {
    9.             return null;
    10.         }
    11.         // Bean name or resolved handler?
    12.         if (handler instanceof String) {
    13.             String handlerName = (String) handler;
    14.             handler = obtainApplicationContext().getBean(handlerName);
    15.         }
    17.         HandlerExecutionChain executionChain = getHandlerExecutionChain(handler, request);
    19.         if (logger.isTraceEnabled()) {
    20.             logger.trace("Mapped to " + handler);
    21.         }
    22.         else if (logger.isDebugEnabled() && !request.getDispatcherType().equals(DispatcherType.ASYNC)) {
    23.             logger.debug("Mapped to " + executionChain.getHandler());
    24.         }
    26.         // 判断是否为跨域请求
    27.         if (CorsUtils.isCorsRequest(request)) {
    28.             CorsConfiguration globalConfig = this.corsConfigurationSource.getCorsConfiguration(request);
    29.             // 当前请求的跨域配置
    30.             CorsConfiguration handlerConfig = getCorsConfiguration(handler, request);
    31.             CorsConfiguration config = (globalConfig != null ? globalConfig.combine(handlerConfig) : handlerConfig);
    32.             executionChain = getCorsHandlerExecutionChain(request, executionChain, config);
    33.         }
    35.         return executionChain;
    36.     }

判断是否跨域

  • org.springframework.web.cors.CorsUtils#isCorsRequest
  1.     public static boolean isCorsRequest(HttpServletRequest request) {
  2.         // 是否携带 请求头:Origin
  3.         return (request.getHeader(HttpHeaders.ORIGIN) != null);
  4.     }

获取跨域信息

  1.         // 判断是否为跨域请求
  2.         if (CorsUtils.isCorsRequest(request)) {
  3.             CorsConfiguration globalConfig = this.corsConfigurationSource.getCorsConfiguration(request);
  4.             // 当前请求的跨域配置
  5.             CorsConfiguration handlerConfig = getCorsConfiguration(handler, request);
  6.             CorsConfiguration config = (globalConfig != null ? globalConfig.combine(handlerConfig) : handlerConfig);
  7.             executionChain = getCorsHandlerExecutionChain(request, executionChain, config);
  8.         }

跨域拦截器创建

  1.     protected HandlerExecutionChain getCorsHandlerExecutionChain(HttpServletRequest request,
  2.                                                                  HandlerExecutionChain chain, @Nullable CorsConfiguration config) {
  4.         if (CorsUtils.isPreFlightRequest(request)) {
  5.             HandlerInterceptor[] interceptors = chain.getInterceptors();
  6.             chain = new HandlerExecutionChain(new PreFlightHandler(config), interceptors);
  7.         }
  8.         else {
  9.             // 创建跨域拦截器
  10.             chain.addInterceptor(new CorsInterceptor(config));
  11.         }
  12.         return chain;
  13.     }

跨域拦截器

  1.     /**
  2.      * 跨域拦截器
  3.      */
  4.     private class CorsInterceptor extends HandlerInterceptorAdapter implements CorsConfigurationSource {
  6.         @Nullable
  7.         private final CorsConfiguration config;
  9.         public CorsInterceptor(@Nullable CorsConfiguration config) {
  10.             this.config = config;
  11.         }
  13.         @Override
  14.         public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
  15.                 throws Exception {
  17.             return corsProcessor.processRequest(this.config, request, response);
  18.         }
  20.         @Override
  21.         @Nullable
  22.         public CorsConfiguration getCorsConfiguration(HttpServletRequest request) {
  23.             return this.config;
  24.         }
  25.     }

DefaultCorsProcessor

  • 经过跨域拦截器 CorsInterceptor之后会调用

image-20200123093733129

  1.     @Override
  2.     @SuppressWarnings("resource")
  3.     public boolean processRequest(@Nullable CorsConfiguration config, HttpServletRequest request,
  4.                                   HttpServletResponse response) throws IOException {
  6.         // 判断是否跨域请求
  7.         if (!CorsUtils.isCorsRequest(request)) {
  8.             return true;
  9.         }
  11.         ServletServerHttpResponse serverResponse = new ServletServerHttpResponse(response);
  12.         // 判断是否有 Access-Control-Allow-Origin
  13.         if (responseHasCors(serverResponse)) {
  14.             logger.trace("Skip: response already contains \"Access-Control-Allow-Origin\"");
  15.             return true;
  16.         }
  18.         ServletServerHttpRequest serverRequest = new ServletServerHttpRequest(request);
  19.         if (WebUtils.isSameOrigin(serverRequest)) {
  20.             logger.trace("Skip: request is from same origin");
  21.             return true;
  22.         }
  24.         boolean preFlightRequest = CorsUtils.isPreFlightRequest(request);
  25.         if (config == null) {
  26.             if (preFlightRequest) {
  27.                 rejectRequest(serverResponse);
  28.                 return false;
  29.             }
  30.             else {
  31.                 return true;
  32.             }
  33.         }
  35.         return handleInternal(serverRequest, serverResponse, config, preFlightRequest);
  36.     }

模拟请求

  1. GET http://localhost:9999/json
  2. Origin: localhost

变量截图

image-20200123093032179