SpringBoot项目[禁止OPTIONS等不安全的请求]增加OPTIONS不安全请求处理

1
/**
2
 * @author XK
3
 */
4
@Component
5
public class XssFilter implements Filter {
6

7
    @Override
8
    public void init(FilterConfig config) throws ServletException {
9
    }
10

11
    @Override
12
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
13
            throws IOException, ServletException {
14
        XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(
15
                (HttpServletRequest) request);
16
        HttpServletResponse httpServletResponse = (HttpServletResponse) response;
17
        //这里填写你允许进行跨域的主机ip
18
        httpServletResponse.setHeader("Access-Control-Allow-Origin", "*");
19
        //允许的访问方法，* 代表全部可以访问
20
        httpServletResponse.setHeader("Access-Control-Allow-Methods", "POST, GET");
21

22
        //Access-Control-Max-Age 用于 CORS 相关配置的缓存
23
        httpServletResponse.setHeader("Access-Control-Max-Age", "3600");
24
        httpServletResponse.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept,token");
25

26
        if ("OPTIONS".equalsIgnoreCase(((HttpServletRequest) request).getMethod())){
27
            ((HttpServletResponse) response).setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
28
            ServletOutputStream outputStream = response.getOutputStream();
29
            outputStream.write(new String("不安全的请求".getBytes(),"utf-8").getBytes());
30
            outputStream.flush();
31
        }
32
        chain.doFilter(xssRequest, httpServletResponse);
33
    }
34

35
    @Override
36
    public void destroy() {
37
    }
38

39
}