package com.talentcard.server.config;
|
|
import java.util.Arrays;
|
import java.util.List;
|
|
import org.springframework.beans.factory.annotation.Value;
|
import org.springframework.context.annotation.Bean;
|
import org.springframework.context.annotation.Configuration;
|
import org.springframework.web.cors.CorsConfiguration;
|
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
|
import org.springframework.web.filter.CorsFilter;
|
|
@Configuration
|
public class ApiCorsConfig {
|
@Bean
|
public CorsFilter apiCorsFilter(
|
@Value("${app.cors.allowed-origins:}") String allowedOrigins,
|
@Value("${app.cors.allowed-origin-patterns:}") String allowedOriginPatterns) {
|
CorsConfiguration cors = new CorsConfiguration();
|
cors.setAllowedOrigins(split(allowedOrigins));
|
// 本地开发工具的端口是随机的（微信开发者工具每次启动都换一个），写死端口必然漏。
|
// 用 origin 通配覆盖本机各种调试端口，真实域名仍走上面的精确白名单。
|
cors.setAllowedOriginPatterns(split(allowedOriginPatterns));
|
cors.setAllowedMethods(List.of("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"));
|
cors.setAllowedHeaders(List.of("Content-Type", "Authorization", "X-Request-Id",
|
"X-Client-Platform", "X-Client-Version", "X-Merchant-Store-Id", "X-Idempotency-Key"));
|
cors.setMaxAge(3600L);
|
|
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
|
source.registerCorsConfiguration("/api/**", cors);
|
// Complete browser preflight before MVC authentication interceptors run.
|
return new CorsFilter(source);
|
}
|
|
private static List<String> split(String values) {
|
return Arrays.stream(values.split(",")).map(String::trim).filter(value -> !value.isEmpty()).toList();
|
}
|
}
|
