Shulou(Shulou.com)06/03 Report--

This article mainly shows you the "sample analysis of cross-domain access caused by SpringCloud front and back separation". The content is simple and easy to understand and clearly organized. I hope it can help you solve your doubts. Let Xiaobian lead you to study and learn the article "sample analysis of cross-domain access caused by SpringCloud front and back separation".

Spring Cloud microservices pilot transformation, currently trying to separate the front and back ends.

The foreground application A (local port 8080) calls the http service issued by the background application B(local port 8082) and application C through the network management (local port 8769).

The js code for A is as follows:

Error reported after operation:

XMLHttpRequest cannot load http://127.0.0.1:8769/service-B/getResInfo. No 'Access-Control-Allow-Origin' header is present on the requested resource.

Origin 'http://localhost:8080' is therefore not allowed access.

Cause of the problem: A's foreground accesses B's application, resulting in cross-domain.

Cross-domain access violates the same-origin policy, which states that a browser's Ajax can only access resources that are same-origin (same domain name or IP) from its foreground page.

That is, if A's foreground accesses A's background, there is no cross-domain.

solutions

Option 1:

Add the @CrossOrigin annotation to the invoked class or method to declare that it supports cross-domain access

origins=* indicates that all sources are allowed, and specific sources can also be defined, such as domain1.com

allowCredentials=true indicates that Access-Control-Allow-Credentials=true will be added to the response

If only one service needs to be accessed across domains, this solution is feasible.

However, since we have separated the front and back ends, the foreground calls are cross-domain services. This scheme needs to add annotations to the methods or classes corresponding to almost all B and C applications, which is not appropriate.

Moreover, if both B and C services are open for cross-domain access, there may be a security risk because other unknown applications can also access these services.

Option 2:

Add CorsFilter to the network management zuul, for example, add the red part code directly to the startup class in the following figure.

Since this scheme is added to the network management, there is no modification to the codes applied by B and C.

And because B and C do not directly open cross-domain access, other applications cannot access B and C services across, for example, A directly accesses B and C applications without passing through the gateway, and the access fails.

Single sign-on verification will be performed on SSO on the network management application assembly to better ensure service security.

The above is all the content of this article "Example analysis of cross-domain access caused by separation of front and back ends of SpringCloud". Thank you for reading! I believe that everyone has a certain understanding, hope to share the content to help everyone, if you still want to learn more knowledge, welcome to pay attention to the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.