最近在做個專案，啟用了Angularjs作為前端框架，後端則使用java服務端，引入了shiro框架作為許可權管理。 理想是豐滿的，現實是骨感的。 起先單域測試下一切Ok，進行二級域名跨域測試就出現問題了。

遇到坑以及填坑

1.Access-Control-Allow-Origin，Access-Control-Allow-Headers，Access-Control-Allow-Methods 跨域請求的時候遇到了Access-Control-Allow-Origin問題，起先在Filter中是這麼解決的，程式碼如下：

response.addHeader("Access-Control-Allow-Origin","*");
response.addHeader("Access-Control-Allow-Headers", "accept, content-type");
response.addHeader("Access-Control-Allow-Methods", "DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT");
 

private String getDomain(String host) {
   if (host.endsWith(domain)) {
     return SecondDomainKit.contains(host.substring(0, host.length() - (domain.length() + 1)));
   } else  return null;
}

/ 校驗資料來源，成功後進行跨域授權
String origin = request.getHeader("Origin");
if (StrKit.notBlank(origin)) {
     Pattern pattern = Pattern.compile("([a-zA-z]+://){0,1}([^\\s]*)");
     Matcher matcher = pattern.matcher(origin);
     if (matcher.find()) {
         String host = matcher.group(2);
         if (host.endsWith(domain) && !host.equals(domain) && StrKit.notBlank(getDomain(host))) {
             response.addHeader("Access-Control-Allow-Origin",
             request.getScheme() + "://" + getDomain(host) + "." + domain);
             response.addHeader("Access-Control-Allow-Headers", "accept, content-type");
             response.addHeader("Access-Control-Allow-Methods", "DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT");
         }
     }
}
 

sessionIdCookie = org.apache.shiro.web.servlet.SimpleCookie
sessionIdCookie.name = JMSESSIONID #可修改Cookie的名稱
sessionIdCookie.domain = xxxx.com #這裡填入頂級域名
sessionIdCookie.maxAge = 604800
...
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
sessionManager.sessionIdCookie = $sessionIdCookie
sessionManager.sessionIdCookieEnabled = true
...
 

app.config(['$httpProvider', function($httpProvider) {
   $httpProvider.defaults.withCredentials = true;
}]);

// 校驗資料來源，成功後進行跨域授權
String origin = request.getHeader("Origin");
if (StrKit.notBlank(origin)) {
     Pattern pattern = Pattern.compile("([a-zA-z]+://){0,1}([^\\s]*)");
     Matcher matcher = pattern.matcher(origin);
     if (matcher.find()) {
         String host = matcher.group(2);
         if (host.endsWith(domain) && !host.equals(domain) && StrKit.notBlank(getDomain(host))) {
             response.addHeader("Access-Control-Allow-Origin",
             request.getScheme() + "://" + getDomain(host) + "." + domain);
             response.addHeader("Access-Control-Allow-Headers", "accept, content-type");
             response.addHeader("Access-Control-Allow-Methods", "DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT");
             // 是否支援cookie跨域
             response.addHeader("Access-Control-Allow-Credentials", "true"); 
         }
     }
}