@Configuration
public class CorsConfig implements WebMvcConfigurer {

    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")  // 允許所有路徑
                .allowedOrigins("*")  // 允許所有來(lái)源，生產(chǎn)環(huán)境應(yīng)限制具體域名
                .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")  // 允許的HTTP方法
                .allowedHeaders("*")  // 允許所有請(qǐng)求頭
                .exposedHeaders("Authorization")  // 暴露的響應(yīng)頭
                .allowCredentials(true)  // 允許攜帶憑證(cookie)
                .maxAge(3600);  // 預(yù)檢請(qǐng)求結(jié)果緩存時(shí)間（秒）
    }
}

@Configuration
public class CorsConfig {

    @Bean
    public CorsFilter corsFilter() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        
        // 設(shè)置允許的源
        config.addAllowedOrigin("*");
        // 設(shè)置允許的HTTP方法
        config.addAllowedMethod("*");
        // 設(shè)置允許的請(qǐng)求頭
        config.addAllowedHeader("*");
        // 設(shè)置允許攜帶憑證
        config.setAllowCredentials(true);
        // 設(shè)置暴露的響應(yīng)頭
        config.addExposedHeader("Authorization");
        // 設(shè)置預(yù)檢請(qǐng)求結(jié)果緩存時(shí)間
        config.setMaxAge(3600L);
        
        source.registerCorsConfiguration("/**", config);
        return new CorsFilter(source);
    }
}

// 控制器類(lèi)級(jí)別配置
@RestController
@RequestMapping("/api")
@CrossOrigin(origins = "*", maxAge = 3600)
public class ApiController {
    
    @GetMapping("/data")
    public ResponseEntity<String> getData() {
        return ResponseEntity.ok("Data response");
    }
}

// 方法級(jí)別配置
@RestController
@RequestMapping("/api")
public class ApiController {
    
    @GetMapping("/data")
    @CrossOrigin(origins = "http://localhost:3000", 
                allowedHeaders = "*",
                methods = {RequestMethod.GET, RequestMethod.POST})
    public ResponseEntity<String> getData() {
        return ResponseEntity.ok("Data response");
    }
}

@Component
public class CorsFilter extends OncePerRequestFilter {
    
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                    HttpServletResponse response, 
                                    FilterChain filterChain) throws ServletException, IOException {
        
        // 設(shè)置CORS響應(yīng)頭
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "*");
        response.setHeader("Access-Control-Expose-Headers", "Authorization");
        response.setHeader("Access-Control-Allow-Credentials", "true");
        
        // 處理預(yù)檢請(qǐng)求
        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
            response.setStatus(HttpServletResponse.SC_OK);
            return;
        }
        
        filterChain.doFilter(request, response);
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            // 添加CORS配置
            .cors().and()
            // 禁用CSRF（如果需要）
            .csrf().disable()
            // 其他安全配置...
            .authorizeRequests()
            .antMatchers("/public/**").permitAll()
            .anyRequest().authenticated();
    }
    
    // 注入CORS配置Bean
    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("*"));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
        configuration.setAllowedHeaders(Arrays.asList("*"));
        configuration.setExposedHeaders(Arrays.asList("Authorization"));
        configuration.setAllowCredentials(true);
        configuration.setMaxAge(3600L);
        
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

config.setAllowedOrigins(Arrays.asList("https://www.example.com", "https://app.example.com"));

config.setAllowedMethods(Arrays.asList("GET", "POST"));