请求后端接口报错：IllegalArgumentException: When allowCredentials is true, allowedOrigins cannot contain ...

墨蓝 2024-02-18 13:22 12阅读 0赞

#### 目录 ####

*   *  一、问题
     *  二、报错信息
     *  三、WebMvcConfigurer
     *  四、原因
     *  五、解决

--------------------

### 一、问题 ###

请求后端接口时出现异常

--------------------

### 二、报错信息 ###

java.lang.IllegalArgumentException: When allowCredentials is true, allowedOrigins cannot contain the special value "*" since that cannot be set on the "Access-Control-Allow-Origin" response header. To allow credentials to a set of origins, list them explicitly or consider using "allowedOriginPatterns" instead.
    	at org.springframework.web.cors.CorsConfiguration.validateAllowCredentials(CorsConfiguration.java:473)
    	at org.springframework.web.servlet.handler.AbstractHandlerMapping.getHandler(AbstractHandlerMapping.java:532)
    	at org.springframework.web.servlet.DispatcherServlet.getHandler(DispatcherServlet.java:1265)
    	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1047)
    	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:964)
    	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)
    	at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:898)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:670)
    	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:779)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    	at com.alibaba.druid.support.http.WebStatFilter.doFilter(WebStatFilter.java:123)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
    	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
    	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:177)
    	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
    	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
    	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
    	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
    	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)
    	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)
    	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:891)
    	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1784)
    	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    	at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
    	at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
    	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    	at java.lang.Thread.run(Thread.java:748)

--------------------

### 三、WebMvcConfigurer ###

@Configuration
    @EnableWebMvc
    @ComponentScan
    public class WebMvcConfiguration implements WebMvcConfigurer {
        
    
        private String fileBasePath = "xxx/xxx";
    
        @Override
        public void addResourceHandlers(ResourceHandlerRegistry registry) {
        
            registry.addResourceHandler("/upload/**").addResourceLocations("file:" + fileBasePath + File.separator);
        }
    
        @Bean
        public ViewResolver viewResolver() {
        
            InternalResourceViewResolver resolver = new InternalResourceViewResolver();
            resolver.setPrefix("/WEB-INF/");
            resolver.setSuffix(".jsp");
            resolver.setViewNames("jsp/*");
            resolver.setOrder(2);
            return resolver;
        }
    
        @Bean
        public ITemplateResolver templateResolver() {
        
            SpringResourceTemplateResolver templateResolver = new SpringResourceTemplateResolver();
            templateResolver.setTemplateMode("HTML5");
            templateResolver.setPrefix("/WEB-INF/");
            templateResolver.setSuffix(".html");
            templateResolver.setCharacterEncoding("utf-8");
            templateResolver.setCacheable(false);
            return templateResolver;
        }
    
        @Bean
        public SpringTemplateEngine templateEngine() {
        
            SpringTemplateEngine templateEngine = new SpringTemplateEngine();
            templateEngine.setTemplateResolver(templateResolver());
            return templateEngine;
        }
    
        @Bean
        public ThymeleafViewResolver viewResolverThymeLeaf() {
        
            ThymeleafViewResolver viewResolver = new ThymeleafViewResolver();
            viewResolver.setTemplateEngine(templateEngine());
            viewResolver.setCharacterEncoding("utf-8");
            viewResolver.setViewNames(new String[] {
         "thymeleaf/*" });
            viewResolver.setOrder(1);
            return viewResolver;
        }
    
        @Override
        public void configureDefaultServletHandling(DefaultServletHandlerConfigurer configurer) {
        
            configurer.enable();
        }
    
        @Override
        public void addCorsMappings(CorsRegistry registry){
        
            registry.addMapping("/**")
            		//问题出现在这一行，上面的配置可以忽略
                    .allowedOrigins("*")
                    .allowedMethods("*")
                    .allowedHeaders("*")
                    .allowCredentials(true)
                    .maxAge(3600);
        }
    }

--------------------

### 四、原因 ###

`SpringBoot`升级`2.4.0`之后，跨域配置中的`.allowedOrigins`不再可用

原先的`SpringBoot`版本为`2.1.3.RELEASE`，后来升级为`2.7.8`，导致问题出现

--------------------

### 五、解决 ###

从报错信息：`When allowCredentials is true, allowedOrigins cannot contain the special value "*" since that cannot be set on the "Access-Control-Allow-Origin" response header. To allow credentials to a set of origins, list them explicitly or consider using "allowedOriginPatterns" instead.`就可以找到解决的方法

将`allowedOrigins`替换为`allowedOriginPatterns`

@Override
        public void addCorsMappings(CorsRegistry registry){
        
            registry.addMapping("/**")
            		//将 allowedOrigins 替换为 allowedOriginPatterns
            		//.allowedOrigins("*")
                    .allowedOriginPatterns("*")
                    .allowedMethods("*")
                    .allowedHeaders("*")
                    .allowCredentials(true)
                    .maxAge(3600);
        }