GlassFish：如何设置访问控制 - 允许源标头

Question

我正在使用最新版本的GlassFish。我想在响应中设置Access-Control-Allow-Origin标头，以便可以从任何域调用托管在GlassFish上的API。但我无法找出设置它的位置。

Answer 1

在我的情况下，API请求完全由泽西处理，因此我可以在ContainerResponseFilter设置响应头：

<servlet> 
    <servlet-name>Gateway Servlet</servlet-name> 
    <servlet-class>com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class> 
    <init-param> 
     <param-name>com.sun.jersey.spi.container.ContainerResponseFilters</param-name> 
     <param-value>my.app.CrossOriginResourceSharingFilter</param-value> 
    </init-param> 
    <load-on-startup>1</load-on-startup> 
</servlet> 

：

package my.app; 

import com.sun.jersey.spi.container.ContainerRequest; 
import com.sun.jersey.spi.container.ContainerResponse; 
import com.sun.jersey.spi.container.ContainerResponseFilter; 

public class CrossOriginResourceSharingFilter implements ContainerResponseFilter { 

    @Override 
    public ContainerResponse filter(ContainerRequest creq, ContainerResponse cresp) { 

     cresp.getHttpHeaders().putSingle("Access-Control-Allow-Origin", "*"); 
     cresp.getHttpHeaders().putSingle("Access-Control-Allow-Credentials", "true"); 
     cresp.getHttpHeaders().putSingle("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT"); 
     cresp.getHttpHeaders().putSingle("Access-Control-Allow-Headers", "Content-Type, Accept"); 

     return cresp; 
    } 
} 

过滤器被在web.xml中启用如果你不使用Jersey，我想你可以创建一个类似的servlet响应过滤器。

Answer 2

这是一个Java EE标准的方式来做到这一点。它与Jersey示例几乎完全相同，只是使用的库包（javax）和获取标头的方法调用不同（getHeaders）。

import java.io.IOException; 
import javax.ws.rs.container.ContainerRequestContext; 
import javax.ws.rs.container.ContainerResponseContext; 
import javax.ws.rs.container.ContainerResponseFilter; 
import javax.ws.rs.ext.Provider; 

@Provider 
public class RestResponseFilter implements ContainerResponseFilter{ 

@Override 
    public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) throws IOException{ 
     responseContext.getHeaders().putSingle("Access-Control-Allow-Origin", "*"); 
     responseContext.getHeaders().putSingle("Access-Control-Allow-Credentials", "true"); 
     responseContext.getHeaders().putSingle("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT"); 
     responseContext.getHeaders().putSingle("Access-Control-Allow-Headers", "Content-Type, Accept"); 
    } 

} 

Answer 3

由于您使用标签java-ee-6，我相信@Provider不受支持。我用下面的代码的基础上，javaee6 tutorial：

import java.io.IOException; 
import java.util.logging.Logger; 
import javax.servlet.Filter; 
import javax.servlet.FilterChain; 
import javax.servlet.FilterConfig; 
import javax.servlet.ServletException; 
import javax.servlet.ServletRequest; 
import javax.servlet.ServletResponse; 
import javax.servlet.annotation.WebFilter; 
import javax.servlet.http.HttpServletResponse; 

@WebFilter(filterName = "AddHeaderFilter", urlPatterns = {"/*"}) 
public class ResponseFilter implements Filter { 

    private final static Logger log = Logger.getLogger(ResponseFilter.class.getName()); 

    @Override 
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { 
    if (response instanceof HttpServletResponse) { 
     log.info("Adding headers"); 
     HttpServletResponse http = (HttpServletResponse) response; 
     http.addHeader("Access-Control-Allow-Origin", "*"); 
     http.addHeader("Access-Control-Allow-Credentials", "true"); 
     http.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT"); 
    } 
    chain.doFilter(request, response); 
} 

Answer 4

这样做的最好的，最简单的方法，就是在项目右键单击

，并选择跨来源资源共享过滤