Before separation before and after the talk, let's look at what is around one. When we use when javaweb development site eventually we render jsp or springthymeleaf. Our page is actually under WEB-INFO or templates. When a user requests our xxx page resources are not really the requested page, but processed through our controller, after generating modelAndView, in view resolver to find the final data into view, and the view through the response and only then streamed to the client. in this development environment, we requested web page is actually in the container, this is the natural domain access.
If we move out of the entire html file, then visit our controller via ajax mode, then controller and html is not in one environment, it creates cross-domain access. In generating cross-domain access, the browser is requesting the order 1 options to initiate a type of request to the server, the request is sent to the server doubt, you will allow me to access it? this question contains the conditions there, the client request header, client address, client requests mode, and so on. If the server allows clients of these conditions, then tell the client browser, you can send a request for real this time the browser will send the actual request.
So then we look at the server configuration, which is the rule of the stack.
It is configured so foolproof, the premise is that your client does not pass cookie.
Do javaweb developed friends all know, java for each client in a session. The session is based on a cookie JSESSION be screened identity.
If the project is around one, each request will bring the default cookie, but if it is before and after the separation does not always carry the cookie. Then we need to be configured on the client side
I used here is axios plug
Then each will carry the cookie, but that did not end. If the client wants to carry the cookie, then the server
You must explicitly specify the release of the client domain name. Actually, this is a protective measure, imagine, if the server allows each strange client access, so if there are bad guys to carry large amounts cookie carry out his service by the end, then how.
At this point, before and after the separation caused by cross-domain cookie access and carry the problem to get.