首先,我已经在this page上检查了这个问题,我尝试了他的解决方案,但最后,我仍然有同样的问题。
XMLHttpRequest无法加载http://localhost:8080/login
。对预处理请求的响应未通过访问控制检查:请求的资源上不存在“Excell-Control-Allow-Origin”标头。因此不允许访问Origin http://localhost:3000
。响应的HTTP状态代码为403。
但是,我把一个access-control
到处所以我不明白为什么它是这样的。
我的代码看起来像这样(我希望我能为你写得足够多):
在Angular中,我的login.service.ts
:
check(name: string, password: string): boolean {
let headers = new Headers();
headers.append('Content-Type', 'application/x-www-form-urlencoded');
headers.append('Access-Control-Allow-Origin','*');
let options = new RequestOptions({headers:headers,withCredentials:true});
if(this.http.post(this.baseUrl,
`username=${name}&password=${password}`,
{headers:headers})
.toPromise().then(response=> {
return {}
}))
return true;
return false;
}
字符串
如果认证成功,我还想返回一个布尔值,但我真的不知道如何知道它是否有效,所以我现在这样做(它总是为真)。
在Java中,我有这样的代码:
@Configuration
@EnableWebMvc
class WebConfig extends WebMvcConfigurerAdapter {
}
型
为了安全起见,我买了这个
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private RESTLoginSuccessHandler loginSuccessHandler;
@Autowired
private RestLogoutSuccessHandler logoutSuccessHandler;
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
//deactivate CSRF and use custom impl for CORS
httpSecurity
.cors.and()
.csrf().disable()
.addFilterBefore(new CorsFilter(), ChannelProcessingFilter.class);
//authorize, authenticate rest
httpSecurity
.authorizeRequests()
.anyRequest().hasRole("USER")
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
.and()
.formLogin()
.usernameParameter("username")
.passwordParameter("password")
.loginPage("/login")
.successHandler(loginSuccessHandler)
.permitAll()
.and()
.logout()
.logoutSuccessHandler(this.logoutSuccessHandler)
.permitAll();
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("rano").password("1234").roles("USER");
auth.inMemoryAuthentication().withUser("admin").password("admin").roles("USER", "ADMIN");
}
}
@Bean
CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Arrays.asList("http://localhost:8080","http://localhost:3000"));
configuration.setAllowedMethods(Arrays.asList("PUT","DELETE","POST"));
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
型
在我的登录页面中:
@Component
public class RESTLoginSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
private RequestCache requestCache = new HttpSessionRequestCache();
@Override
public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
org.springframework.security.core.Authentication authentication) throws IOException, ServletException {
SavedRequest savedRequest = requestCache.getRequest(request, response);
if (savedRequest == null) {
clearAuthenticationAttributes(request);
return;
}
String targetUrlParam = getTargetUrlParameter();
if (isAlwaysUseDefaultTargetUrl()
|| (targetUrlParam != null && StringUtils.hasText(request.getParameter(targetUrlParam)))) {
requestCache.removeRequest(request, response);
clearAuthenticationAttributes(request);
return;
}
clearAuthenticationAttributes(request);
}
public void setRequestCache(RequestCache requestCache) {
this.requestCache = requestCache;
}
}
型
那么,有什么问题吗?或者如何使用Sping Boot 和Spring Security制作Angular2应用程序?因为除了添加安全性之外,Sping Boot 和Angular之间的所有功能都可以正常工作。
1条答案
按热度按时间des4xlb01#
将以下内容添加到configure方法中
字符串