允许传递cookie时，origin不能为通配符

phoenix · Aug 20, 2015 · 67c43a4 · 67c43a4
1 parent ab52e38
commit 67c43a4
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/main/java/edu/scup/web/filter/CORSFilter.java b/src/main/java/edu/scup/web/filter/CORSFilter.java
@@ -13,7 +13,8 @@ public class CORSFilter extends OncePerRequestFilter {
  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
  throws ServletException, IOException {
- response.addHeader("Access-Control-Allow-Origin", "*");
+ String origin = request.getHeader("Origin");
+ response.addHeader("Access-Control-Allow-Origin", origin);//允许传递cookie时，origin不能为通配符
 
  if (request.getHeader("Access-Control-Request-Method") != null && "OPTIONS".equals(request.getMethod())) {
  // CORS "pre-flight" request