使用@CrossOrigin(origins="*")
时会有响应头Access-Control-Allow-Origin: *
。这时前端设置withCredential
会报错Failed to load http://localhost:8080/test: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin 'http://localhost:3000' is therefore not allowed access.
能否对所有的请求网站都设置对应的响应头,如localhost:3000
访问就设置Access-Control-Allow-Origin: localhost:3000
。
被告知
@CrossOrigin
标注无法实现,可以通过过滤器Filter实现。看了下Filter确实可以实现,mdn有简单的示例。