update cors

Author: JoyChou93

java-sec-code.iml

@@ -59,7 +59,7 @@
     <orderEntry type="library" name="Maven: org.codehaus.groovy:groovy:2.4.7" level="project" />
     <orderEntry type="library" name="Maven: mysql:mysql-connector-java:8.0.12" level="project" />
     <orderEntry type="library" name="Maven: com.google.protobuf:protobuf-java:2.6.0" level="project" />
-    <orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.48" level="project" />
+    <orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.24" level="project" />
     <orderEntry type="library" name="Maven: org.jdom:jdom2:2.0.6" level="project" />
     <orderEntry type="library" name="Maven: org.dom4j:dom4j:2.1.1" level="project" />
     <orderEntry type="library" name="Maven: com.google.guava:guava:21.0" level="project" />

pom.xml

@@ -82,12 +82,6 @@
             <version>21.0</version>
         </dependency>
 
-        <dependency>
-            <groupId>com.google.guava</groupId>
-            <artifactId>guava</artifactId>
-            <version>21.0</version>
-        </dependency>
-
         <dependency>
             <groupId>commons-collections</groupId>
             <artifactId>commons-collections</artifactId>

src/main/java/org/joychou/controller/CORS.java

@@ -27,19 +27,17 @@ public class CORS {
     private static String vuls1(HttpServletRequest request, HttpServletResponse response) {
         // 获取Header中的Origin
         String origin = request.getHeader("origin");
-
         response.setHeader("Access-Control-Allow-Origin", origin); // 设置Origin值为Header中获取到的
-        // response.setHeader("Access-Control-Allow-Methods", "POST, GET");
         response.setHeader("Access-Control-Allow-Credentials", "true");  // cookie
         return info;
     }
 
     @RequestMapping("/vuls2")
     @ResponseBody
     private static String vuls2(HttpServletResponse response) {
+        // 不建议设置为*
+        // 后端设置Access-Control-Allow-Origin为*的情况下，跨域的时候前端如果设置withCredentials为true会异常
         response.setHeader("Access-Control-Allow-Origin", "*");
-        // response.setHeader("Access-Control-Allow-Methods", "POST, GET");
-        // response.setHeader("Access-Control-Allow-Credentials", "true");
         return info;
     }
 
@@ -61,9 +59,8 @@ private static String seccode(HttpServletRequest request, HttpServletResponse re
         if ( origin != null && !sec.checkSafeUrl(origin, urlwhitelist) ) {
             return "Origin is not safe.";
         }
-        response.setHeader("Access-Control-Allow-Origin", "*");
-        // response.setHeader("Access-Control-Allow-Methods", "POST, GET");
-        // response.setHeader("Access-Control-Allow-Credentials", "true");
+        response.setHeader("Access-Control-Allow-Origin", origin);
+        response.setHeader("Access-Control-Allow-Credentials", "true");
         return info;
     }