过滤器（Filter）解决跨域问题

最近在做一个项目，前端资源与服务端单独部署。遇到一个跨域问题，常见的跨域问题可以通过jsonp方式解决。下面介绍另一种解决方式：
服务端环境：spring + dubbo + tomcat
第一步：在WEB-INF目录下添加一个crossdomain.xml文件，内容如下：

表示web服务器允许任何domain的请求。
第二步：
在web.xml中添加一个新的过滤器Filter--crossDomainFilter。

  Archetype CreatedWeb Application
  
    contextConfigLocation
    classpath*:spring-main.xml
  
  
    timeoutMinutes
    120
  
  
    encodingFilter
    org.springframework.web.filter.CharacterEncodingFilter
    
      encoding
      UTF-8
    
    
      forceEncoding
      true
    
  
  
    encodingFilter
    /*
  
  
  crossDomainFilter
    com.*.resource.web.utils.CrossDomainFilter
    
        file
        /WEB-INF/web-config.properties
    
  
  
    org.springframework.web.context.ContextLoaderListener
  
  
    dispatcher
    org.springframework.web.servlet.DispatcherServlet
    
      contextConfigLocation
      classpath*:springmvc-servlet.xml
    
    1
  
  
    dispatcher
    *.do
  
  
    crossDomainFilter
    *.do
  
  
    120
  
  
    index.html
  

crossDomainFilter中增加crossDomain方法：

package com.*.resource.web.utils;

import java.io.FileInputStream;
import java.io.IOException;
import java.util.Properties;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang.exception.ExceptionUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.context.ApplicationContext;
import org.springframework.web.context.support.WebApplicationContextUtils;

/**
 *
 * @author 
 * @date
 */
public class CrossDomainFilter implements Filter {

    private static final Logger log = LoggerFactory.getLogger(CrossDomainFilter.class);

    private Properties pp = new Properties();

    private FilterConfig config;

    private String allowDomain = "http://allow.com";

    @Override
    public void destroy() {
        pp = null;
        this.config = null;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {

        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse resp = (HttpServletResponse) response;

        // 得到请求的uri和url
        String reqUri = req.getRequestURI();
        String reqUrl = req.getRequestURL().toString();
        log.info(" reqUri:{} ,reqUrl:{} ", reqUri, reqUrl);

        // 跨域处理
        this.crossDomain(req, resp, reqUrl);
        chain.doFilter(req, resp);

    }

    @Override
    public void init(FilterConfig config) throws ServletException {

    }

    /**
     * 处理跨域问题
     */
    private void crossDomain(HttpServletRequest request, HttpServletResponse response, String url) {
        response.setHeader("Content-type", "text/html;charset=UTF-8");
        response.setCharacterEncoding("UTF-8");
        response.setHeader("Access-Control-Allow-Credentials", "true");

        log.info("REFERER:{}", request.getHeader("REFERER"));
        String referer = request.getHeader("REFERER");
        String reqRefererDomain = "";
        if (referer != null && referer.length() > referer.indexOf(".com") + 4) {
            reqRefererDomain = referer.substring(0, referer.indexOf(".com") + 4);
            log.info("reqRefererDomain:{}", reqRefererDomain);
            if (reqRefererDomain.equals(allowDomain)) {
                response.setHeader("Access-Control-Allow-Origin", allowDomain );
            }
        }

        response.setHeader("Access-Control-Allow-Credentials", "true");
        response.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
        response.setHeader("Access-Control-Allow-Headers",
                "Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With");

    }

}

解决跨域的关键：

response.setHeader("Access-Control-Allow-Origin", allowDomain );