SpringSecurity实战教程（十二）CORS安全配置 - 跨域请求的安全详解

1
@Configuration
2
@EnableWebSecurity
3
public class SecurityConfig {
4

5
    @Bean
6
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
7
        http
8
            .cors(cors -> cors
9
                .configurationSource(corsConfigurationSource())
10
            )
11
            .authorizeHttpRequests(auth -> auth
12
                .anyRequest().authenticated()
13
            );
14
            // 其他安全配置...
15
        return http.build();
16
    }
17

18
    @Bean
19
    CorsConfigurationSource corsConfigurationSource() {
20
        CorsConfiguration config = new CorsConfiguration();
21
        config.setAllowedOrigins(List.of("https://your-domain.com"));
22
        config.setAllowedMethods(List.of("GET", "POST"));
23
        config.setAllowedHeaders(List.of("Authorization", "Content-Type"));
24
        config.setExposedHeaders(List.of("X-Custom-Header"));
25
        config.setMaxAge(3600L);
26
        config.setAllowCredentials(true);
27

28
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
29
        source.registerCorsConfiguration("/**", config);
30
        return source;
31
    }
32
}

1
@Bean
2
CorsConfigurationSource corsConfigurationSource(Environment env) {
3
    CorsConfiguration config = new CorsConfiguration();
4

5
    // 从环境变量读取允许的源
6
    String allowedOrigins = env.getProperty("cors.allowed.origins", "");
7
    config.setAllowedOrigins(Arrays.asList(allowedOrigins.split(",")));
8

9
    config.applyPermitDefaultValues();
10
    config.setAllowCredentials(true);
11

12
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
13
    source.registerCorsConfiguration("/**", config);
14
    return source;
15
}

1
@Bean
2
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
3
    http
4
        .cors(withDefaults())
5
        .headers(headers -> headers
6
            .httpStrictTransportSecurity(hsts -> hsts
7
                .includeSubDomains(true)
8
                .preload(true)
9
                .maxAgeInSeconds(63072000)
10
            )
11
            .xssProtection(xss -> xss
12
                .headerValue(XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK)
13
            )
14
            .contentSecurityPolicy(csp -> csp
15
                .policyDirectives("default-src 'self'")
16
            )
17
        );
18
    return http.build();
19
}