设置tomcat允许跨域

当我们跨服务器访问时，有时会遇到跨域问题，下面是Apache提供的一种解决跨域的方案，简单粗暴，

直接修改tomcat的conf文件夹下的web.xml文件，在web-app标签里新增下方的过滤规则，

添加后重启tomcat即可

 

  CorsFilter
  org.apache.catalina.filters.CorsFilter
 
    cors.allowed.origins
    *
 
 
    cors.allowed.methods
    GET,POST,HEAD,OPTIONS,PUT
 
 
    cors.allowed.headers
    Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
 
 
    cors.exposed.headers
    Access-Control-Allow-Origin,Access-Control-Allow-Credentials
 
 
    cors.support.credentials
    true
 
 
    cors.preflight.maxage
    1800
 


  CorsFilter
  /*

以下是各项参数的详细描述

param-name	description
cors.allowed.origins	A list of origins that are allowed to access the resource. A '' can be specified to enable access to resource from any origin. Otherwise, a whitelist of comma separated origins can be provided. Ex: http://www.w3.org, https://www.apache.org. Defaults:(Any origin is allowed to access the resource).
cors.allowed.methods	A comma separated list of HTTP methods that can be used to access the resource, using cross-origin requests. These are the methods which will also be included as part of 'Access-Control-Allow-Methods' header in a pre-flight response. Ex: GET,POST. Defaults: GET,POST,HEAD,OPTIONS
cors.allowed.headers	A comma separated list of request headers that can be used when making an actual request. These header will also be returned as part of 'Access-Control-Allow-Headers' header in a pre-flight response. Ex: Origin,Accept. Defaults: Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers
cors.exposed.headers	A comma separated list of headers other than the simple response headers that browsers are allowed to access. These are the headers which will also be included as part of 'Access-Control-Expose-Headers' header in the pre-flight response. Ex: X-CUSTOM-HEADER-PING,X-CUSTOM-HEADER-PONG. Default: None
cors.preflight.maxage	The amount of seconds, browser is allowed to cache the result of the pre-flight request. This will be included as part of 'Access-Control-Max-Age' header in the pre-flight response. A negative value will prevent CORS Filter from adding this response header from pre-flight response. Defaults: 1800
cors.support.credentials	A flag that indicates whether the resource supports user credentials. This flag is exposed as part of 'Access-Control-Allow-Credentials' header in a pre-flight response. It helps browser determine whether or not an actual request can be made using credentials. Defaults: true
cors.logging.enabled	A flag to control logging to container logs. Defaults: false
cors.request.decorate	A flag to control if the request should be decorated or not. Defaults: true