RestTemplate 未通过 Origin 标头 [英] RestTemplate not passing Origin header

问题描述

我正在尝试使用 Spring 的 RestTemplate 发出跨域请求.通信是在两个 Spring-boot webapps 之间完成的，它们都运行在 localhost 但不同的端口上.我要做的是:

I'm trying to make a cross-origin request using Spring's RestTemplate. The communication is done between two Spring-boot webapps, both running on localhost but different port. What I do is:

HttpHeaders httpHeaders = new HttpHeaders();
httpHeaders.setOrigin("http://localhost:8083");
httpHeaders.add("Authorization", token);

HttpEntity<Void> httpEntity = new HttpEntity<>(httpHeaders);

ParameterizedTypeReference<List<MyObj>> beanType = new ParameterizedTypeReference<List<MyObj>>() {};
ResponseEntity<List<MyObj>> list = restTemplate.exchange(serviceURL, HttpMethod.GET, httpEntity, beanType);

调用被执行，Authorization"标头传递得很好，但无论我尝试什么，接收端都没有Origin"标头.当我使用其他工具(SoapUI、RestClient Chrome 插件等)创建类似的请求时，标头会按照我提供的方式传递.

The call is executed, the "Authorization" header is passed just fine, but no matter what I try, there is no "Origin" header on the receiving side. When I create a simillar request using some other tool (SoapUI, RestClient Chrome plugin, etc.) the header is passed just as I provide it.

为了在接收端打印所有标题，我使用了 javax.servlet.Filter 的实现:

To print all headers on the receiving side I'm using a implementation of javax.servlet.Filter with:

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
        throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    Enumeration<String> headerNames = request.getHeaderNames();
    while (headerNames.hasMoreElements()) {
        String headerName = headerNames.nextElement();
        log.info(headerName + ": " + request.getHeader(headerName));
    }
}

为什么使用 RestTemplate 时不传递 origin 头?

Why is the origin header not passed when using RestTemplate?

推荐答案

遇到了同样的问题，我花了一个世纪才解决.

Had the same problem which I spent a century to fix.

根本原因是 RestTemplate 文档中的这一行

The root cause is this line from the RestTemplate documentation

注意:默认情况下，RestTemplate 依赖于标准的 JDK 工具来建立 HTTP 连接.

Note: by default the RestTemplate relies on standard JDK facilities to establish HTTP connections.

如果您查看 Java 中 HttpUrlConnection 类的源代码，您会发现下面的代码块，头文件 Origin 是禁止更改的受限头文件之一:

If you check source code of HttpUrlConnection class in Java, you'll find below block of code, and header Origin is one of the restricted headers that forbid changes:

/*
 * Restrict setting of request headers through the public api
 * consistent with JavaScript XMLHttpRequest2 with a few
 * exceptions. Disallowed headers are silently ignored for
 * backwards compatibility reasons rather than throwing a
 * SecurityException. For example, some applets set the
 * Host header since old JREs did not implement HTTP 1.1.
 * Additionally, any header starting with Sec- is
 * disallowed.
 *
 * The following headers are allowed for historical reasons:
 *
 * Accept-Charset, Accept-Encoding, Cookie, Cookie2, Date,
 * Referer, TE, User-Agent, headers beginning with Proxy-.
 *
 * The following headers are allowed in a limited form:
 *
 * Connection: close
 *
 * See http://www.w3.org/TR/XMLHttpRequest2.
 */
 private static final boolean allowRestrictedHeaders;
 private static final Set<String> restrictedHeaderSet;
 private static final String[] restrictedHeaders = {
    /* Restricted by XMLHttpRequest2 */
    //"Accept-Charset",
    //"Accept-Encoding",
    "Access-Control-Request-Headers",
    "Access-Control-Request-Method",
    "Connection", /* close is allowed */
    "Content-Length",
    //"Cookie",
    //"Cookie2",
    "Content-Transfer-Encoding",
    //"Date",
    //"Expect",
    "Host",
    "Keep-Alive",
    "Origin",
    // "Referer",
    // "TE",
    "Trailer",
    "Transfer-Encoding",
    "Upgrade",
    //"User-Agent",
    "Via"
};

这个问题有一个简单的解决方法，只需设置一个JVM参数

There is a easy fix to this problem, just to set a JVM argument

-Dsun.net.http.allowRestrictedHeaders=true 

或在代码中添加一行

System.setProperty("sun.net.http.allowRestrictedHeaders", "true");

抑制限制.

这篇关于RestTemplate 未通过 Origin 标头的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！