春季CorsFilter似乎仍然工作仍然收到401上的预检请求

Question

您好我是春季安全新手，并试图找出如何配置auth服务器发出令牌。我现在所拥有的问题是，我收到关于进一步了解CORS预检要求401或403，不知道如何解决以下是基于几个教程

https://spring.io/blog/2015/06/08/cors-support-in-spring-framework http://www.baeldung.com/spring-security-oauth-jwt

@Configuration 
@EnableWebSecurity 
@EnableGlobalMethodSecurity 
@PropertySource(value = "classpath:oauth.properties") 
public class SecurityConfig extends WebSecurityConfigurerAdapter { 

    @Autowired 
    UserRepository userRepository; 


    @Override 
    protected void configure(AuthenticationManagerBuilder auth) 
      throws Exception { 
     auth.authenticationProvider(authenticationProvider()); 
    } 


    @Override 
    public void configure(WebSecurity web) throws Exception { 

     super.configure(web); 
    } 

    @Autowired 
    ObjectMapper mapper; 




    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http.csrf().disable(); 

     http.authorizeRequests().antMatchers(HttpMethod.OPTIONS,"/oauth/token").permitAll() 
     .anyRequest().authenticated(); 
    } 




    @Override 
    @Bean 
    public AuthenticationManager authenticationManagerBean() throws Exception { 
     return super.authenticationManagerBean(); 
    } 

    @Override 
    protected void configure(final AuthenticationManagerBuilder auth) throws Exception{ 

     auth.inMemoryAuthentication(). 
     withUser("john").password("123").roles("USER"). 
     and(). 
     withUser("tom").password("111").roles("ADMIN"); 

    } 
    @Bean 
    public FilterRegistrationBean corsFilter() { 
     FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter2()); 
     bean.setOrder(0); 
     return bean; 
    } 


} 


@Configuration 
@EnableAuthorizationServer 
public class OAuth2ServerConfig extends AuthorizationServerConfigurerAdapter{ 

    @Autowired 
    private Environment env; 

    @Autowired 
    @Qualifier("authenticationManagerBean") 
    private AuthenticationManager authenticationManager; 


    @Override 
    public void configure(AuthorizationServerSecurityConfigurer oauthServer){ 
     oauthServer.tokenKeyAccess("permitAll()").checkTokenAccess("isAuthenticated()"); 
    } 


    @Override 
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception{ 
     clients.inMemory().withClient("acme").secret("acmesecret").authorizedGrantTypes("authorization_code", "refresh_token", 
        "password").scopes("openId"); 
    } 

    @Override 
    public void configure(AuthorizationServerEndpointsConfigurer endpoints){ 
     final TokenEnhancerChain tokenEnhancerChain = new TokenEnhancerChain(); 
     tokenEnhancerChain.setTokenEnhancers(Arrays.asList(tokenEnhancer(),accessTokenConverter())); 
     endpoints.tokenStore(tokenStore()) 
       .tokenEnhancer(tokenEnhancerChain) 
       .authenticationManager(authenticationManager); 

    } 

    @Bean 
    public JwtAccessTokenConverter accessTokenConverter(){ 
     final JwtAccessTokenConverter converter = new JwtAccessTokenConverter(); 
     return converter; 
    } 

    @Bean 
    public TokenStore tokenStore(){ 

     return new JwtTokenStore(accessTokenConverter()); 

    } 

    @Bean 
    public FilterRegistrationBean corsFilter() { 
     FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter2()); 
     bean.setOrder(0); 
     return bean; 
    } 

    @Bean 
    @Primary 
    public DefaultTokenServices tokenServices() { 
     DefaultTokenServices defaultTokenServices = new DefaultTokenServices(); 
     defaultTokenServices.setTokenStore(tokenStore()); 
     defaultTokenServices.setSupportRefreshToken(true); 
     return defaultTokenServices; 
    } 
} 

准系统实现它

CorsFilter2是spring 4.2中引入的spring cors过滤器。我正在使用它来插入正确的响应头文件发送回客户端。

Answer 1

所以我想通了，我的问题，我有什么配置我websecurity忽略CoresRequest请求，以及因此对于websecurity配置块内我必须设置该

web.ignoring().requestMatchers(CorsUtils::isPreFlightRequest); 

，并开始工作。