CORS - Spring Boot 3 更新

Question

我将 Vaadin 应用程序更新到 Spring Boot 3，现在我在启动时收到以下警告

Cache miss for REQUEST dispatch to '/ui/login' (previous null). Performing CorsConfiguration lookup. This is logged once only at WARN level, and every time at TRACE.

通过添加以下 Bean，错误就会消失：

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Arrays.asList("https://test.com"));
    configuration.setAllowedMethods(Arrays.asList("*"));
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

消息随着这个Bean消失，但我不确定它是否正确。我读了很多关于 CORS 的内容，但不太了解它的细节。也许任何人都可以帮助我或告诉我如何正确处理。

这是我的 WebSecurityConfig：

@Configuration
@EnableWebSecurity
public class TestWebSecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests((requests) -> {
            requests.requestMatchers(AntPathRequestMatcher.antMatcher(MAPPING + "**")).hasAuthority("abc");
            requests.anyRequest().permitAll();
        });

        http.httpBasic(Customizer.withDefaults());
        http.csrf((customizer) -> customizer.disable());
        http.headers((customizer) -> customizer.disable());
        
        return http.build();
    }
    
        @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("xyz")
            .password("xyz")
            .authorities("abc");
    }
    
}

提前致谢！

Answer 1

这是自 Spring Boot 3.2.0 以来的已知行为，因为此处描述了 Spring 框架更改。该修复已在 Spring Security 中实现，并将于今年 12 月晚些时候包含在 Spring Boot 3.2.1 中。