在Tomcat中設置CORS標頭

Question

我有一個由Tomcat託管的靜態網站。

如何設置一個標題爲我的網站，如：Access-Control-Allow-Origin: *

他們都是靜態文件，沒有任何servlet應用。

Answer 1

如果它是一個靜態的網站，然後在Tomcat 7.0.41開始，你可以很容易地控制通過一個built-in filter CORS行爲。

相當多，你所要做的就是編輯CATALINA_HOME/conf全球web.xml，並添加過濾器定義的唯一的事：

 
    <!-- ================== Built In Filter Definitions ===================== --> 

     ... 

    <filter> 
     <filter-name>CorsFilter</filter-name> 
     <filter-class>org.apache.catalina.filters.CorsFilter</filter-class> 
    </filter> 
    <filter-mapping> 
     <filter-name>CorsFilter</filter-name> 
     <url-pattern>/*</url-pattern> 
    </filter-mapping> 

    <!-- ==================== Built In Filter Mappings ====================== --> 

要知道，不過，Firefox不喜歡Access-Control-Allow-Origin: *和要求與憑證（Cookie ）：when responding to a credentialed request, server must specify a domain, and cannot use wild carding.

Answer 2

您需要添加一個Filter添加額外的頭，配置它的所有路徑

<filter> 
    <filter-name>header</filter-name> 
    <filter-class>...</filter-class> 
</filter> 
<filter-mapping> 
    <filter-name>header</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping> 

Answer 3

這是一個非常基本的過濾器將添加CORS標頭。請注意，默認情況下，這將啓用所有域和方法，因此您應該對其進行自定義以適合您的需求。

它也需要是您的web.xml中的第一個過濾器。

package com.conductiv.api.listener; 

import javax.servlet.*; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 
import java.io.IOException; 

public class CORSFilter implements Filter { 
    public void destroy() { 
    } 
    public static String VALID_METHODS = "DELETE, HEAD, GET, OPTIONS, POST, PUT"; 

    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, IOException { 
     HttpServletRequest httpReq = (HttpServletRequest) req; 
     HttpServletResponse httpResp = (HttpServletResponse) resp; 

     // No Origin header present means this is not a cross-domain request 
     String origin = httpReq.getHeader("Origin"); 
     if (origin == null) { 
      // Return standard response if OPTIONS request w/o Origin header 
      if ("OPTIONS".equalsIgnoreCase(httpReq.getMethod())) { 
       httpResp.setHeader("Allow", VALID_METHODS); 
       httpResp.setStatus(200); 
       return; 
      } 
     } else { 
      // This is a cross-domain request, add headers allowing access 
      httpResp.setHeader("Access-Control-Allow-Origin", origin); 
      httpResp.setHeader("Access-Control-Allow-Methods", VALID_METHODS); 

      String headers = httpReq.getHeader("Access-Control-Request-Headers"); 
      if (headers != null) 
       httpResp.setHeader("Access-Control-Allow-Headers", headers); 

      // Allow caching cross-domain permission 
      httpResp.setHeader("Access-Control-Max-Age", "3600"); 
     } 
     // Pass request down the chain, except for OPTIONS 
     if (!"OPTIONS".equalsIgnoreCase(httpReq.getMethod())) { 
      chain.doFilter(req, resp); 
     } 
} 

    public void init(FilterConfig config) throws ServletException { 

    } 

}