Java JAX-RS CORS / Tomcat冲突：javax.servlet.ServletException

Question

我目前正在运行自己的网络应用程序，它通常不会给我任何设置环境的问题。但是，这是一台使用Tomcat 9.0和JDK 8设置的新机器。只有Eclipse IDE的版本才能正常工作。

在此环境中，所有资源都返回404，并且我在运行时将其原因缩小到：

javax.servlet.ServletException：当allowedOrigins = [*]时，不允许配置supportsCredentials = [true]

任何人都知道为什么不再允许/为什么它不起作用？

在src / main / webapp / WEB-INF / web.xml中，CORS过滤器添加如下：

<?xml version="1.0" encoding="UTF-8"?>
<!-- This web.xml file is not required when using Servlet 3.0 container,
     see implementation details http://jersey.java.net/nonav/documentation/latest/jax-rs.html -->
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
    <servlet>
        <servlet-name>Jersey Web Application</servlet-name>
        <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
        <init-param>
            <param-name>jersey.config.server.provider.packages</param-name>
            <param-value>lksecure.lks,lksecure,messenger.msg</param-value>             
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>Jersey Web Application</servlet-name>
        <url-pattern>/webapi`/`*</url-pattern>
    </servlet-mapping>

  <filter>
    <filter-name>CorsFilter</filter-name>
    <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
    <init-param>
      <param-name>cors.allowed.origins</param-name>
      <param-value>*</param-value>
    </init-param>
    <init-param>
      <param-name>cors.allowed.methods</param-name>
      <param-value>GET,POST,DELETE,HEAD,OPTIONS</param-value>
    </init-param>
    <init-param>
      <param-name>cors.allowed.headers</param-name>
      <param-value>Content-Type,auth,user,persona,target,recaptcha,id,endpoint,portX-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value>
    </init-param>
    <init-param>
      <param-name>cors.exposed.headers</param-name>
      <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
    </init-param>
    <init-param>
      <param-name>cors.support.credentials</param-name>
      <param-value>true</param-value>
    </init-param>
    <init-param>
      <param-name>cors.preflight.maxage</param-name>
      <param-value>10</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>CorsFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>
</web-app>

谢谢！

Answer 1

你必须提供逗号分隔的允许来源的白名单，也有supportCredentials = [true]：http://tomcat.apache.org/tomcat-7.0-doc/config/filter.html#CORS_Filter

如何缩小问题范围以及如何找出您必须为Tomcats web.xml添加哪些URL cors.allowed.origins参数在此解释：https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors

出于安全原因，在2018年5月引入了这种行为：https://bz.apache.org/bugzilla/show_bug.cgi?id=62343