为OPTIONS Http方法禁用Spring Security
是否可以为某种HTTP方法禁用Spring Security? 我们有一个Spring REST应用程序,其服务需要在HTTP请求的标头中附加授权令牌。我正在为此编写一个JS客户端,并使用JQuery发送GET / POST请求。该应用程序使用此过滤器代码启用了CORS。 doFilter(....) { HttpServletResponse httpResp = (HttpServletResponse) response; httpResp.setHeader("Access-Control-Allow-Origin", "*"); httpResp.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE"); httpResp.setHeader("Access-Control-Max-Age", "3600"); Enumeration<String> headersEnum = ((HttpServletRequest) request).getHeaders("Access-Control-Request-Headers"); StringBuilder headers = new StringBuilder(); String delim = ""; while (headersEnum.hasMoreElements()) { headers.append(delim).append(headersEnum.nextElement()); delim = ", "; } httpResp.setHeader("Access-Control-Allow-Headers", headers.toString()); } 但是,当JQuery发送针对CORS的OPTIONS请求时,服务器将以“授权失败”令牌进行响应。显然,OPTIONS请求缺少授权令牌。那么有可能让OPTIONS从Spring Security …