Springboot前后端分离项目，配置跨域
项目登录流程如下
用户进入前端登录界面，输入账号密码等，输入完成之后前端发送请求到后端(拦截器不会拦截登录请求)，后端验证账号密码等成功之后生成Token并存储到数据库，数据库中包含该Token过期时间，然后返回生成的Token到前端。
前端收到Token，表示登录成功，把这个Token存储本地。然后跳转到用户中心页面，用户中心页面在ajax的请求头中带上Token，跟随请求用户数据接口一起带到后端。
后端通过拦截器拦截到这个请求，去判断这个Token是否有效，有效就放过去做他该做的事情，无效就抛出异常。
跨域配置
先说一下这个前后分离的项目，已经配置过跨域这些问题。我这里后端WebMvcConfig配置的方式如下：
import com.zdyl.devicemanagement.interceptor.AccessInterceptor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
import org.springframework.web.filter.CorsFilter;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import javax.annotation.Resource;
import java.util.ArrayList;
import java.util.List;
@Configuration
public class WebMvcConfig implements WebMvcConfigurer {
@Resource
private WebServerConfig webServerConfig;
@Bean
public AccessInterceptor getAccessInterceptor() {
return new AccessInterceptor();
}
@Override
public void addInterceptors(InterceptorRegistry registry) {
List<String> excludeUrl = new ArrayList<>();
excludeUrl.add("/error");
excludeUrl.add("/v1/zdyl/downloadFile");
excludeUrl.add("/v1/zdyl/lcoStation/qrcode/**");
excludeUrl.add("/devicemanagement/images/**/*");
excludeUrl.add("/upgrade/**");
excludeUrl.add("/v1/zdyl/login/**");
excludeUrl.add("/NewsImage/**");
excludeUrl.add("/v1/zdyl/equipment/alarm/toExcel/test");
excludeUrl.add("/v1/zdyl/deviceMonitoring/get/alarm/toExcel/**");
registry.addInterceptor(getAccessInterceptor()).addPathPatterns("/**")
.excludePathPatterns(excludeUrl);
}
@Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
List<String> locations = new ArrayList<String>();
locations.add("classpath:/META-INF/resources/");
locations.add("classpath:/resources/");
locations.add("classpath:/public/");
locations.add("file:" + webServerConfig.getUploadFileLocation());
locations.add("file:" + webServerConfig.getPicpath());
locations.add("file:" + webServerConfig.getProjectsource());
String[] myArray = new String[locations.size()];
registry.addResourceHandler("/**").addResourceLocations(locations.toArray(myArray));
}
@Bean
public CorsFilter corsFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
config.addAllowedOrigin("*");
config.addAllowedHeader("*");
config.addAllowedMethod("*");
source.registerCorsConfiguration("/**", config);
return new CorsFilter(source);
}
@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedHeaders("*")
.allowCredentials(true)
.allowedOrigins("*")
.allowedMethods("POST", "GET", "DELETE", "PUT", "OPTIONS")
.maxAge(3600);
}
}
前端每次发送请求也都有在ajax里面设置xhrFields:{withCredentials: true}属性。
拦截器代码
import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.baomidou.mybatisplus.core.toolkit.StringUtils;
import com.zdyl.devicemanagement.common.exception.RRException;
import com.zdyl.devicemanagement.common.utils.AccountNumber;
import com.zdyl.devicemanagement.common.utils.RedisSavePrefix;
import com.zdyl.devicemanagement.common.utils.RedisUtils;
import com.zdyl.devicemanagement.common.utils.SystemConstants;
import com.zdyl.devicemanagement.entity.LcoUsers;
import com.zdyl.devicemanagement.entity.Login;
import com.zdyl.devicemanagement.service.LcoUsersService;
import lombok.extern.slf4j.Slf4j;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
import javax.annotation.Resource;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Date;
@Slf4j
public class AccessInterceptor extends HandlerInterceptorAdapter {
@Resource
private RedisUtils redisUtils;
@Resource
private LcoUsersService lcoUsersService;
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
log.info("------------------------AccessInterceptor-------------------------");
if (request.getMethod().equals(RequestMethod.OPTIONS.name())) {
return super.preHandle(request, response, handler);
}
//获取请求token，如果token不存在，直接返回401
String token = getRequestToken(request);
String loginId = getRequestloginId(request);
if (StringUtils.isEmpty(token)) {
throw new RRException("token为空", 401);
}
if (StringUtils.isEmpty(loginId)) {
throw new RRException("loginId为空", 401);
}
Object users = redisUtils.getObject(redisUtils.getKey(RedisSavePrefix.Login, loginId), AccountNumber.loginDataBase);
if (users == null) {
throw new RRException("用户尚未登录", 401);
}
Login loginUser = JSONObject.parseObject(JSON.toJSONString(users), Login.class);
if (!loginUser.getToken().equals(token)) {
throw new RRException("token不匹配", 401);
}
Date loginTime = loginUser.getLoginTime();
long exitTime = loginTime.getTime() / 1000 + 7200;
long time = new Date().getTime();
long nowTime = new Date().getTime() / 1000;
if (nowTime > exitTime) {
throw new RRException("token已过期！", 401);
}
QueryWrapper<LcoUsers> lcoUsersQueryWrapper = new QueryWrapper<>();
lcoUsersQueryWrapper.eq("phone", loginUser.getLoginID());
LcoUsers lcoUsers = lcoUsersService.getOne(lcoUsersQueryWrapper);
request.setAttribute(SystemConstants.CURRENTUSER, lcoUsers);
return super.preHandle(request, response, handler);
}
/**
* 获取请求的token
*/
private String getRequestToken(HttpServletRequest httpRequest) {
//从header中获取token
String host = httpRequest.getHeader("token");
//如果header中不存在token，则从参数中获取token
if (StringUtils.isEmpty(host)) {
host = httpRequest.getParameter("token");
}
// if (StringUtils.isEmpty(host)) {
// Cookie[] cks = httpRequest.getCookies();
// for (Cookie cookie : cks) {
// if (cookie.getName().equals("yzjjwt")) {
// host = cookie.getValue();
// return host;
// }
// }
// }
return host;
}
/**
* 获取请求的loginId
*/
private String getRequestloginId(HttpServletRequest httpRequest) {
//从header中获取token
String loginId = httpRequest.getHeader("loginId");
//如果header中不存在token，则从参数中获取token
if (StringUtils.isEmpty(loginId)) {
loginId = httpRequest.getParameter("loginId");
}
// if (StringUtils.isEmpty(loginId)) {
// Cookie[] cks = httpRequest.getCookies();
// for (Cookie cookie : cks) {
// if (cookie.getName().equals("yzjjwt")) {
// loginId = cookie.getValue();
// return loginId;
// }
// }
// }
return loginId;
}
/**
* 对跨域提供支持
*/
protected boolean addCors(ServletRequest request, ServletResponse response) throws Exception {
HttpServletRequest httpServletRequest = (HttpServletRequest) request;
HttpServletResponse httpServletResponse = (HttpServletResponse) response;
httpServletResponse.setHeader("Access-control-Allow-Origin", httpServletRequest.getHeader("Origin"));
httpServletResponse.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS,PUT,DELETE");
httpServletResponse.setHeader("Access-Control-Allow-Headers", httpServletRequest.getHeader("Access-Control-Request-Headers"));
// 跨域时会首先发送一个option请求，这里我们给option请求直接返回正常状态
if (httpServletRequest.getMethod().equals(RequestMethod.OPTIONS.name())) {
httpServletResponse.setStatus(HttpStatus.OK.value());
return false;
}
return super.preHandle(request, response);
}
}
自定义异常RRException代码
/** * 自定义异常 */ public class RRException extends RuntimeException { private static final long serialVersionUID = 1L; private String message; private String code = "INVALID"; private int status = 0; public RRException(String msg) { super(msg); this.message = msg; } public RRException(String msg, Throwable e) { super(msg, e); this.message = msg; } public RRException(String msg, String code) { super(msg); this.message = msg; this.code = code; } public RRException(String msg, int status) { super(msg); this.message = msg; this.status = status; } public RRException(String msg, String code, Throwable e) { super(msg, e); this.message = msg; this.code = code; } public String getMsg() { return message; } public void setMsg(String msg) { this.message = msg; } public String getCode() { return code; } public void setCode(String code) { this.code = code; } public int getStatus() { return status; } public void setStatus(int status) { this.status = status; } }
