Ajax跨域问题在SpringMVC中的解决方案总结

@RequestMapping(method = RequestMethod.POST, value = "/update.json", produces = MediaType.APPLICATION_JSON_VALUE)  public @ResponseBody Contacter update(@RequestBody Contacter contacterRO) {    logger.debug("get update request {}", contacterRO.toString());   if (contacterRO.getUserId() == 123) {     contacterRO.setUserName("adminUpdate-wangdachui");   }    return contacterRO;  } 

(function() {     var url = "http://localhost:8080/api/Home/update.json";      var data = {         "userId": 123,         "userName": "wangdachui"     };     $.ajax({         url: url,         type: 'POST',         dataType: 'json',         data: $.toJSON(data),         contentType: 'application/json'     }).done(function(result) {         console.log("success");         console.log(result);     }).fail(function() {         console.log("error");     }) })() 

Object {userId: 123, userName: "adminUpdate-wangdachui"} 

OPTIONS http://localhost:8080/api/Home/update.json XMLHttpRequest cannot load http://localhost:8080/api/Home/update.json. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access. The response had HTTP status code 403. 

Access-Control-Allow-Origin: http://foo.org  Access-Control-Max-Age: 3628800  Access-Control-Allow-Methods: GET，PUT, DELETE  Access-Control-Allow-Headers: content-type  "Access-Control-Allow-Origin"表明它允许"http://foo.org"发起跨域请求  "Access-Control-Max-Age"表明在3628800秒内，不需要再发送预检验请求，可以缓存该结果  "Access-Control-Allow-Methods"表明它允许GET、PUT、DELETE的外域请求  "Access-Control-Allow-Headers"表明它允许跨域请求包含content-type头 

Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access. The response had HTTP status code 403. 

DEBUG requestURL:/api/Home/update.json  DEBUG method:OPTIONS  DEBUG header host:localhost:8080  DEBUG header connection:keep-alive  DEBUG header cache-control:max-age=0  DEBUG header access-control-request-method:POST  DEBUG header origin:null  DEBUG header user-agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36  DEBUG header access-control-request-headers:accept, content-type  DEBUG header accept:*/*  DEBUG header accept-encoding:gzip, deflate, sdch  DEBUG header accept-language:zh-CN,zh;q=0.8,en;q=0.6  

@Override public final HandlerExecutionChain getHandler(HttpServletRequest request) throws Exception {  Object handler = getHandlerInternal(request);  if (handler == null) {   handler = getDefaultHandler();  }  if (handler == null) {   return null;  }  // Bean name or resolved handler?  if (handler instanceof String) {   String handlerName = (String) handler;   handler = getApplicationContext().getBean(handlerName);  }   HandlerExecutionChain executionChain = getHandlerExecutionChain(handler, request);  if (CorsUtils.isCorsRequest(request)) {   CorsConfiguration globalConfig = this.corsConfigSource.getCorsConfiguration(request);   CorsConfiguration handlerConfig = getCorsConfiguration(handler, request);   CorsConfiguration config = (globalConfig != null ? globalConfig.combine(handlerConfig) : handlerConfig);   executionChain = getCorsHandlerExecutionChain(request, executionChain, config);  }  return executionChain; } 

public static boolean isCorsRequest(HttpServletRequest request) {  return (request.getHeader(HttpHeaders.ORIGIN) != null); } 

@Override public void handleRequest(HttpServletRequest request, HttpServletResponse response) throws IOException {  corsProcessor.processRequest(this.config, request, response); } 

@Override public boolean processRequest(CorsConfiguration config, HttpServletRequest request, HttpServletResponse response)   throws IOException {   if (!CorsUtils.isCorsRequest(request)) {   return true;  }   ServletServerHttpResponse serverResponse = new ServletServerHttpResponse(response);  ServletServerHttpRequest serverRequest = new ServletServerHttpRequest(request);   if (WebUtils.isSameOrigin(serverRequest)) {   logger.debug("Skip CORS processing, request is a same-origin one");   return true;  }  if (responseHasCors(serverResponse)) {   logger.debug("Skip CORS processing, response already contains /"Access-Control-Allow-Origin/" header");   return true;  }   boolean preFlightRequest = CorsUtils.isPreFlightRequest(request);  if (config == null) {   if (preFlightRequest) {    rejectRequest(serverResponse);    return false;   }   else {    return true;   }  }   return handleInternal(serverRequest, serverResponse, config, preFlightRequest); } 

response.setHeader("Access-Control-Allow-Origin", "*"); 

Request header field Content-Type is not allowed by Access-Control-Allow-Headers in preflight response. 

response.setHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept"); 

public class CorsConfigurerAdapter extends WebMvcConfigurerAdapter{   @Override  public void addCorsMappings(CorsRegistry registry) {      registry.addMapping("/api/*").allowedOrigins("*");  } } 

<bean class="com.tmall.wireless.angel.web.config.CorsConfigurerAdapter"></bean>