跨域的OPTIONS请求竟然走到了interceptor

跨域的OPTIONS请求竟然走到了interceptor,这对里面的计数产生了影响

option预检请求为什么会走向intercptor呢?
我们debug,查看栈发现请求在FrameworkServlet时走了doOptions方法,如下

@Override
	protected void doOptions(HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {
    
    

		if (this.dispatchOptionsRequest || CorsUtils.isPreFlightRequest(request)) {
    
    
			processRequest(request, response);
			if (response.containsHeader("Allow")) {
    
    
				// Proper OPTIONS response coming from a handler - we're done.
				return;
			}
		}

		// Use response wrapper in order to always add PATCH to the allowed methods
		super.doOptions(request, new HttpServletResponseWrapper(response) {
    
    
			@Override
			public void setHeader(String name, String value) {
    
    
				if ("Allow".equals(name)) {
    
    
					value = (StringUtils.hasLength(value) ? value + ", " : "") + HttpMethod.PATCH.name();
				}
				super.setHeader(name, value);
			}
		});
	}

其中processRequest(request, response);就是后续的方法,最终会走到拦截器和controller
否则直接跳过走下面的直接返回

那么我们可以查看到CorsUtils.isPreFlightRequest(request)

public static boolean isPreFlightRequest(HttpServletRequest request) {
    
    
		return (HttpMethod.OPTIONS.matches(request.getMethod()) &&
				request.getHeader(HttpHeaders.ORIGIN) != null &&
				request.getHeader(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD) != null);
	}

判断条件是OPTIONS且带了Origin的header且带了Access-Control-Request-Method的header
那么原因就在于此,怎么避免?
方法1.让前端去掉Origin或者Access-Control-Request-Method
方法2.写filter,filter在spring之前执行,在前面拦截就行

@Component
@WebFilter(urlPatterns = "/*", filterName = "CorsFilter")
public class CorsFilter implements Filter {
    
    
   
 
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
    
    

    	HttpServletRequest request = (HttpServletRequest) servletRequest;
    	HttpServletResponse response = (HttpServletResponse) servletResponse;
    	response.setHeader("Access-Control-Allow-Origin", "*");//允许任何请求来源        
    	response.setHeader("Access-Control-Allow-Methods", "*");//允许任何method
    	response.setHeader("Access-Control-Allow-Headers", "*");//允许任何自定义header
    	if (!request.getMethod().equals("OPTIONS")){
    
    
    		 filterChain.doFilter(servletRequest, servletResponse);
    	}  
    }
 
}

猜你喜欢

转载自blog.csdn.net/dmw412724/article/details/119823694