跨域处理——前后端分离 session+cookie失效问题

前后端分离，跨域 session+cookie失效问题

问题：

首先登陆成功时将用户存在session中，后续请求在将用户从session中取出检查。后续请求取出的用户都为null。

解决过程：

首先发现sessionID不一致，导致每一次都是新的会话，当然不可能存在用户了。然后发现cookie浏览器不能自动保存，服务器响应set-cookie了。

springboot的配置：

1.后台添加过滤器，因为前后端分离，不可能每个方法都写一遍，所以添加过滤器统一处理。

package com.ys.config;


import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;


@Component
public class CorsFilter implements Filter {

        @Override
        public void destroy() {
        }

        /**
         * 此过滤器只是处理跨域问题
         * @param servletRequest
         * @param servletResponse
         * @param chain
         * @throws ServletException
         * @throws IOException
         */
        @Override
        public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws ServletException, IOException {
            HttpServletRequest request = (HttpServletRequest) servletRequest;
            HttpServletResponse response = (HttpServletResponse) servletResponse;
            String origin = request.getHeader("Origin");
            if(origin == null) {
                origin = request.getHeader("Referer");
            }
            response.setHeader("Access-Control-Allow-Origin", origin);//这里不能写*，*代表接受所有域名访问，如写*则下面一行代码无效。谨记
            //是否允许后续请求携带认证信息（cookies）,该值只能是true,否则不返回
            response.setHeader("Access-Control-Allow-Credentials", "true");
            //允许的请求类型
            response.setHeader("Access-Control-Allow-Methods", "GET,POST,PUT,POST");
            //预检结果缓存时间,也就是上面说到的缓存啦
            response.setHeader("Access-Control-Max-Age", "3600");
            //允许的请求头字段
            response.setHeader("Access-Control-Allow-Headers", "Content-Type,XFILENAME,XFILECATEGORY,XFILESIZE,x-requested-with");
            chain.doFilter(servletRequest,servletResponse);
//        String path = request.getContextPath();
//        String basePath = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort() + path + "/";
//        request.setAttribute("basePath", basePath);
        }

        @Override
        public void init(FilterConfig filterConfig) throws ServletException {
        }

}

然后AJAX配置:

添加xhrFields: {withCredentials: true}。

$.ajax({
    url: '/sysUser/login',
    dataType: 'JSON',
    async:true,
    data: data.field,
    type: 'POST',
    xhrFields: {withCredentials: true},
    success: function (res) {
        window.location.href = './index.html';
    },
    error: function (data) {
        layer.msg('server error:')
    }
})