GlassFish：如何設置訪問控制 - 允許源標頭

Question

我正在使用最新版本的GlassFish。我想在響應中設置Access-Control-Allow-Origin標頭，以便可以從任何域調用託管在GlassFish上的API。但我無法找出設置它的位置。

Answer 1

在我的情況下，API請求完全由澤西處理，因此我可以在ContainerResponseFilter設置響應頭：

<servlet> 
    <servlet-name>Gateway Servlet</servlet-name> 
    <servlet-class>com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class> 
    <init-param> 
     <param-name>com.sun.jersey.spi.container.ContainerResponseFilters</param-name> 
     <param-value>my.app.CrossOriginResourceSharingFilter</param-value> 
    </init-param> 
    <load-on-startup>1</load-on-startup> 
</servlet> 

：

package my.app; 

import com.sun.jersey.spi.container.ContainerRequest; 
import com.sun.jersey.spi.container.ContainerResponse; 
import com.sun.jersey.spi.container.ContainerResponseFilter; 

public class CrossOriginResourceSharingFilter implements ContainerResponseFilter { 

    @Override 
    public ContainerResponse filter(ContainerRequest creq, ContainerResponse cresp) { 

     cresp.getHttpHeaders().putSingle("Access-Control-Allow-Origin", "*"); 
     cresp.getHttpHeaders().putSingle("Access-Control-Allow-Credentials", "true"); 
     cresp.getHttpHeaders().putSingle("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT"); 
     cresp.getHttpHeaders().putSingle("Access-Control-Allow-Headers", "Content-Type, Accept"); 

     return cresp; 
    } 
} 

過濾器被在web.xml中啓用如果你不使用Jersey，我想你可以創建一個類似的servlet響應過濾器。

Answer 2

這是一個Java EE標準的方式來做到這一點。它與Jersey示例幾乎完全相同，只是使用的庫包（javax）和獲取標頭的方法調用不同（getHeaders）。

import java.io.IOException; 
import javax.ws.rs.container.ContainerRequestContext; 
import javax.ws.rs.container.ContainerResponseContext; 
import javax.ws.rs.container.ContainerResponseFilter; 
import javax.ws.rs.ext.Provider; 

@Provider 
public class RestResponseFilter implements ContainerResponseFilter{ 

@Override 
    public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) throws IOException{ 
     responseContext.getHeaders().putSingle("Access-Control-Allow-Origin", "*"); 
     responseContext.getHeaders().putSingle("Access-Control-Allow-Credentials", "true"); 
     responseContext.getHeaders().putSingle("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT"); 
     responseContext.getHeaders().putSingle("Access-Control-Allow-Headers", "Content-Type, Accept"); 
    } 

} 

Answer 3

由於您使用標籤java-ee-6，我相信@Provider不受支持。我用下面的代碼的基礎上，javaee6 tutorial：

import java.io.IOException; 
import java.util.logging.Logger; 
import javax.servlet.Filter; 
import javax.servlet.FilterChain; 
import javax.servlet.FilterConfig; 
import javax.servlet.ServletException; 
import javax.servlet.ServletRequest; 
import javax.servlet.ServletResponse; 
import javax.servlet.annotation.WebFilter; 
import javax.servlet.http.HttpServletResponse; 

@WebFilter(filterName = "AddHeaderFilter", urlPatterns = {"/*"}) 
public class ResponseFilter implements Filter { 

    private final static Logger log = Logger.getLogger(ResponseFilter.class.getName()); 

    @Override 
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { 
    if (response instanceof HttpServletResponse) { 
     log.info("Adding headers"); 
     HttpServletResponse http = (HttpServletResponse) response; 
     http.addHeader("Access-Control-Allow-Origin", "*"); 
     http.addHeader("Access-Control-Allow-Credentials", "true"); 
     http.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT"); 
    } 
    chain.doFilter(request, response); 
} 

Answer 4

這樣做的最好的，最簡單的方法，就是在項目右鍵單擊

，並選擇跨來源資源共享過濾