@Component
public class CorsFilter implements Filter {

 Logger logger= LoggerFactory.getLogger(CorsFilter.class);

 @Override
 public void init(FilterConfig filterConfig) throws ServletException {

 }

 @Override
 public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
  HttpServletRequest request= (HttpServletRequest) servletRequest;
  HttpServletResponse response= (HttpServletResponse) servletResponse;
  response.setHeader("Access-Control-Allow-Origin",request.getHeader("origin"));
  response.setHeader("Access-Control-Allow-Origin","*"); //允許跨域訪問的域
  response.setHeader("Access-Control-Allow-Methods","POST,GET,OPTIONS,DELETE,PUT"); //允許使用的請求方法
  response.setHeader("Access-Control-Expose-Headers","*");
  response.setHeader("Access-Control-Allow-Headers", "x-requested-with,Cache-Control,Pragma,Content-Type,Authorization"); //允許使用的請求方法
  response.setHeader("Access-Control-Allow-Credentials","true");//是否允許請求帶有驗證信息
  filterChain.doFilter(servletRequest, servletResponse);
 }

 @Override
 public void destroy() {

 }
}

 @Override
 protected void configure(HttpSecurity http) throws Exception {
  http
    // 由于使用的是JWT，我們這里不需要csrf
    .csrf().disable()
    // 基于token，所以不需要session
    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
    .authorizeRequests()
    // 所有 / 的所有請求 都放行
    .requestMatchers(CorsUtils::isPreFlightRequest).permitAll() //對preflight放行
    .antMatchers("/*").permitAll()
    .antMatchers("/u").denyAll()
    .antMatchers("/article/**").permitAll()
    .antMatchers("/video/**").permitAll()
    .antMatchers("/api/**").permitAll()
    .antMatchers("/v2/api-docs", "/configuration/ui", "/swagger-resources/**", "/configuration/**","/swagger-ui.html", "/webjars/**")
    .permitAll()
    .antMatchers("/manage/**").hasRole("ADMIN") // 需要相應的角色才能訪問
    // 除上面外的所有請求全部需要鑒權(quán)認證
    .anyRequest().authenticated();

  // 禁用緩存
  http.headers().cacheControl();
  // 添加JWT filter
  http.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
  //添加未授權(quán)處理
  http.exceptionHandling().authenticationEntryPoint(getAuthenticationEntryPoint());
  //權(quán)限不足處理
  http.exceptionHandling().accessDeniedHandler(getAccessDeniedHandler());

 }