“访问控制允许来源：*”对 REST Web 服务没有影响

发布于 2024-10-25 22:00:48 字数 1079 浏览 1 评论 0原文

我从 JavaScript 客户端（在计算机 A 上运行）向 Web 服务器（在计算机 B 上运行）发出 AJAX 调用。客户端尝试访问 RESTful Web 服务 (Jersey) 公开的 URL，但被阻止并出现错误：

来源 http://localhost/ 不是允许的访问控制允许来源

在服务器中，我添加了 2 个标头参数，允许访问任何客户端。然而它没有帮助：

@Context
private HttpServletResponse servlerResponse;

@POST
@Path("testme")
public void test(){
    servlerResponse.addHeader("Access-Control-Allow-Origin", "*");
    servlerResponse.addHeader("Access-Control-Allow-Credentials", "true");
}

相同的标头在 JSP 中工作：

<%
    response.addHeader("Access-Control-Allow-Origin", "*");
    response.addHeader("Access-Control-Allow-Credentials", "true");
%>
<html>
<head><title>test jsp</title></head>
<body>
test
</body>
</html>

我错过了什么吗？

谢谢

P.S 客户端部分是：

$.ajax({
    type: "POST",
    url: "http://localhost:8080/login/testme",
    dataType: 'json',
    success: onLoginSuccess,
    error: onLoginError
});

原文

I make an AJAX call from JavaScript client (running on machine A) to Web server (running on machine B).
Client tries to access a URL exposed by RESTful Web service (Jersey), and it is blocked with error:

Origin http://localhost/ is not
allowed by
Access-Control-Allow-Origin

In server I added 2 header parameters that allow access to any client. However it didn't help:

@Context
private HttpServletResponse servlerResponse;

@POST
@Path("testme")
public void test(){
    servlerResponse.addHeader("Access-Control-Allow-Origin", "*");
    servlerResponse.addHeader("Access-Control-Allow-Credentials", "true");
}

The same headers work in case of JSP:

<%
    response.addHeader("Access-Control-Allow-Origin", "*");
    response.addHeader("Access-Control-Allow-Credentials", "true");
%>
<html>
<head><title>test jsp</title></head>
<body>
test
</body>
</html>

Am I missing something?

thanks

P.S the client part is:

$.ajax({
    type: "POST",
    url: "http://localhost:8080/login/testme",
    dataType: 'json',
    success: onLoginSuccess,
    error: onLoginError
});

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

白况 2024-11-01 22:00:48

作为解决方案，我们实现了 javax.servlet.Filter，它将所需的标头添加到每个响应中：

    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, java.io.IOException {
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) resp;

    // This should be added in response to both the preflight and the actual request
    response.addHeader("Access-Control-Allow-Origin", "*");

    if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
        response.addHeader("Access-Control-Allow-Credentials", "true");
    }

    chain.doFilter(req, resp);
}

As a solution, we implemented javax.servlet.Filter that adds required headers to every response:

    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, java.io.IOException {
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) resp;

    // This should be added in response to both the preflight and the actual request
    response.addHeader("Access-Control-Allow-Origin", "*");

    if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
        response.addHeader("Access-Control-Allow-Credentials", "true");
    }

    chain.doFilter(req, resp);
}

回复收藏 0 原文

懷念過去 2024-11-01 22:00:48

@epeleg这是我做这样的事情的首选方法是过滤响应（Jersey 2.x）：

@Provider
public class CORSFilter implements ContainerResponseFilter {

    @Override
    public void filter(ContainerRequestContext requestContext,
            ContainerResponseContext responseContext) throws IOException {

        responseContext.getHeaders().add("Access-Control-Allow-Origin", "*");
    }
}

@epeleg This is my preferred way of doing things like this is to do filtering of response (Jersey 2.x):

@Provider
public class CORSFilter implements ContainerResponseFilter {

    @Override
    public void filter(ContainerRequestContext requestContext,
            ContainerResponseContext responseContext) throws IOException {

        responseContext.getHeaders().add("Access-Control-Allow-Origin", "*");
    }
}

回复收藏 0 原文

~没有更多了~