CORS问题与Tomcat和Android Webview [英] CORS issue with Tomcat and Android Webview

问题描述

我遇到了一个奇怪的问题与Tomcat 8和CORS。我使用离子框架，AngularJS，Cordova作为前端和Tomcat 8和Spring 3作为后端开发混合Web应用程序。

为了容易开发我测试功能在铬，其中的东西工作正常。我添加了标准配置的CORS过滤器，以允许来自浏览器的CROSS ORIGIN请求。

今天我将应用程序转换为Android应用程序，并开始对tomcat服务器进行AJAX调用。对我的惊喜事情停止工作。

浏览器发送同一呼叫的两个请求OPTION和POST。

浏览器请求标头：

：

 远程地址：54.254.159.166：80 
请求URL：http：//medistreet.in/auth2 
请求方法：选项
状态码：200 OK 
请求标头
选项/ auth2 HTTP / 1.1 
主机：medistreet.in 
连接：keep-alive 
访问控制请求方法：POST 
原产地：http：// localhost 
用户代理：Mozilla / 5.0（Windows NT 6.1; WOW64）AppleWebKit / 537.36 ）Chrome / 34.0.1847.116 Safari / 537.36 
 Access-Control-Request-Headers：accept，content-type 
 Accept：* / * 
 Referer：http：// localhost / 
 Accept-Encoding：gzip，deflate，sdch 
 Accept-Language：en-US，en; q = 0.8 
  

b $ b

POST：

 远程地址：54.254.159.166：80 
请求URL：http： /medistreet.in/auth2 
请求方法：POST 
状态码：200 OK 
 
请求头
接受：application / json，text / plain，* / 
 Accept-Encoding：gzip，deflate，sdch 
 Accept-Language：en-US，en; q = 0.8 
 Connection：keep-alive 
 Content-Length：39 
 Content-Type：application / json; charset = UTF-8 
 Host：medistreet.in 
原产地：http：// localhost 
 Referer：http：// localhost / 
 User-Agent：Mozilla / 5.0（Windows NT 6.1; WOW64）AppleWebKit / 537.36（KHTML，like Gecko）Chrome / 34.0.1847.116 Safari / 537.36 
  

Android请求标头：

 请求网址：http：//medistreet.in/auth2 
方法：POST 
状态码：403禁止
请求头
 POST http://medistreet.in/auth2 HTTP / 1.1 
接受：application / json，text / plain， / * 
原产地：file：// 
 User-Agent：Mozilla / 5.0（Linux; Android 4.4.2; XT1033 Build / KXB20.25-1.31）AppleWebKit / 537.36（KHTML，like Gecko） /4.0 Chrome / 30.0.0.0 Mobile Safari / 537.36 
 Content-Type：application / json; charset = UTF-8 
  

我看到的区别是头部数量，特别是包含file：//的Origin头。为了克服这个我添加更多的选项是CORS过滤器：

 < filter> 
< filter-name> CorsFilter< / filter-name> 
< filter-class> org.apache.catalina.filters.CorsFilter< / filter-class> 
< init-param> 
< param-name> cors.allowed.origins< / param-name> 
< param-value> *< / param-value> 
 < / filter> 
< filter-mapping> 
< filter-name> CorsFilter< / filter-name> 
< url-pattern> / *< / url-pattern> 
< / filter-mapping>另一个奇怪的事情是，当我们发送相同的Android请求Headers从POSTMAN（chrome的REST插件）请求时成功。
 
 
 
 POSTMAN标题：
 远程地址：54.254。 159.166：80 
请求URL：http：//medistreet.in/auth2 
请求方法：POST 
状态码：200 OK 
请求标头
接受：application / json，text / plain，* / * 
 Accept-Encoding：gzip，deflate，sdch 
接受语言：en-US，en; q = 0.8 
 Cache-Control：no-cache 
连接：keep-alive 
内容长度：39 
内容类型：application / json; charset = UTF-8 
 Cookie：fbm_464284963672217 = base_domain = .medistreet.in; JSESSIONID = 87435755F03D7B045DD6E33D1D16AC51; fbsr_464284963672217 = dUjASqF-nWquTFPk_-5wAtI0jTImBNkVxglUT-gHNSw.eyJhbGdvcml 
 Host：medistreet.in 
原产地：chrome-extension：// fdmmgilgnpjigdojojpjoooidkmcomcm 
 User-Agent：Mozilla / 5.0（Windows NT 6.1; WOW64 ）AppleWebKit / 537.36（KHTML，like Gecko）Chrome / 34.0.1847.116 Safari / 537.36 
  
没有解决问题的办法。我怀疑Android Webview不发送Tomcat拒绝的东西。 
 
 
 
任何帮助将非常感激。
解决方案
研究这个问题，并找出问题。如果你看到从Android头，看看原始头。
 原产地：文件： // 
  
 Tomcat CORS过滤器尝试验证Origin标头中的URI，并考虑file：//作为无效URI返回403. 
  * / 
 protected static boolean isValidOrigin（String origin）{
 / * //检查编码字符。有助于防止CRLF注射。 
 if（origin.contains（％））{
 return false; 
} 
 
 URI originURI; 
 
 try {
 originURI = new URI（origin）; 
} catch（URISyntaxException e）{
 return false; 
} 
 //如果URI的方案为null，则返回false。否则返回true。 
 return originURI.getScheme（）！= null; 
 * / 
 return true; 
} 
  
 
 
我需要详细了解Android为什么发送错误的URI。 p> 
I am facing a strange problem with Tomcat 8 and CORS. I am developing a Hybrid web app using ionicframework, AngularJS, Cordova as front end and Tomcat 8 and Spring 3 as back-end.

For easy development I am testing the functionality in chrome , where things are working fine. I added CORS filter with standard configuration to allow CROSS ORIGIN requests from browser.

Today I converted my app into Android App and started making AJAX calls to tomcat server. To my surprise things stopped working . I debugged further and anomalies in the headers of browser and Android webview.

Browser sends 2 requests for same call OPTION and POST. But Android Webview only send POST request.

Browser Request Headers:

OPTION:
Remote Address:54.254.159.166:80
Request URL:http://medistreet.in/auth2
Request Method:OPTIONS
Status Code:200 OK
Request Headers 
OPTIONS /auth2 HTTP/1.1
Host: medistreet.in
Connection: keep-alive
Access-Control-Request-Method: POST
Origin: http://localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36
Access-Control-Request-Headers: accept, content-type
Accept: */*
Referer: http://localhost/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
POST: 
Remote Address:54.254.159.166:80
Request URL:http://medistreet.in/auth2
Request Method:POST
Status Code:200 OK

Request Headers
Accept:application/json, text/plain, */*
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Connection:keep-alive
Content-Length:39
Content-Type:application/json;charset=UTF-8
Host:medistreet.in
Origin:http://localhost
Referer:http://localhost/
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36
Android Request Headers:
Request URL:http://medistreet.in/auth2
Request Method:POST
Status Code:403 Forbidden
Request Headers
POST http://medistreet.in/auth2 HTTP/1.1
Accept: application/json, text/plain, */*
Origin: file://
User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; XT1033 Build/KXB20.25-1.31) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Mobile Safari/537.36
Content-Type: application/json;charset=UTF-8
The difference here I see is with Number of headers and specially Origin Header  which contains "file://". To overcome this I added  more option is CORS filter:
<filter>
        <filter-name>CorsFilter</filter-name>
        <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
            <init-param>
            <param-name>cors.allowed.origins</param-name>
            <param-value>*</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>CorsFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
Another strange thing is that when we send the same Android request Headers from POSTMAN (chrome REST plugin) request is successful.

POSTMAN Headers:
Remote Address:54.254.159.166:80
Request URL:http://medistreet.in/auth2
Request Method:POST
Status Code:200 OK
Request Headers
Accept:application/json, text/plain, */*
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Cache-Control:no-cache
Connection:keep-alive
Content-Length:39
Content-Type:application/json;charset=UTF-8
Cookie:fbm_464284963672217=base_domain=.medistreet.in; JSESSIONID=87435755F03D7B045DD6E33D1D16AC51; fbsr_464284963672217=dUjASqF-nWquTFPk_-5wAtI0jTImBNkVxglUT-gHNSw.eyJhbGdvcml0aG0iOiJITUFDLVNIQTI1NiIsImNvZGUiOiJBUUQ0UEZZVXE4eDFIa3V6OW9RV3RlVzE4clQ3SmtVRjBzU1VVcXhfV1BENG8tV1BZYjZuTVdDdDJGMmw4TjJUeUxLSzhIYUU1TUc2MkY5cXZOaXRMN3NGdklNZkhySmluYkdjMWs1THAyZnZYa2Zpa1lLVGJ0OWlZeXVvRDNWUDhTblp4czJCeTQ4RTlYY1ZjUmhGWGJsNnFMeG5YcWxxQ0d3b0hRM1ctRWhlLU02ejVITnhhakJtaVFRVk9PanFBVUtMSlk4Y3pLa0RtejFSY3RjTEFRaW16X1lkLUFkUngxUGwzajVNczdWOFdiMW9xeC05QjA0T2xraXktVU9ZalpSRUJsZjhibnZjQXQ2aUZTc1d2QTA3TjVUYnFIekVxQ0JIYjJNRG4tSUJhajl6TEMwQlVpckM0YzJXbC1GVDNhcyIsImlzc3VlZF9hdCI6MTM5ODE4MDg2NCwidXNlcl9pZCI6IjU3NjI1MjI2MiJ9
Host:medistreet.in
Origin:chrome-extension://fdmmgilgnpjigdojojpjoooidkmcomcm
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36
After this also there is no solution to the problem .  I suspect that Android Webview is not sending something which Tomcat is rejecting. 

Any help will highly be appreciated.
解决方案
I did more research on this and figure out the issue.If you see the headers from Android and look into Origin Header.
Origin: file://
Tomcat CORS filter tries to validate the URI in Origin header and considers "file://" as an invalid URI and returns back 403.
     */
    protected static boolean isValidOrigin(String origin) {
       /* // Checks for encoded characters. Helps prevent CRLF injection.
        if (origin.contains("%")) {
            return false;
        }

        URI originURI;

        try {
            originURI = new URI(origin);
        } catch (URISyntaxException e) {
            return false;
        }
        // If scheme for URI is null, return false. Return true otherwise.
        return originURI.getScheme() != null;
*/
        return true;
    }
I need to dig more on why Android is sending the incorrect URI.

                        
这篇关于CORS问题与Tomcat和Android Webview的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！