Angularjs 认证过滤器之前的CORS过滤器-安全性较低吗？弹簧安全过滤器链订单

我发现，当从单页应用程序访问ReST服务时，为了正确地允许访问ReST端点，我必须在身份验证过滤器之前注册CORS过滤器。这是安全性较低还是安全性较差

我的安全配置现在看起来像

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Inject
    public void setUserDetailsService(UserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }

    private UserDetailsService userDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder.userDetailsService(userDetailsService)
                .passwordEncoder(new BCryptPasswordEncoder());
    }

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
           .authorizeRequests()
                .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                .antMatchers("/health","/metrics", "/v1/users/register", "/swagger-ui/**", "/v2/api-docs").permitAll()
                .antMatchers("/mappings", "/v1/**", "/backend-service/**").authenticated()
                .and()
            .httpBasic()
                .realmName("serviceGateway")
                .and()
            .csrf()
                .disable()
            .headers()
                .frameOptions().disable()
            .and().addFilterBefore(new SimpleCORSFilter(), ChannelProcessingFilter.class);
    }

}

我的SimpleCORSFilter看起来像

public class SimpleCORSFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    /**
     * This method adds specific headers to the HTTP request to enable CORS
     * requests
     * @param request
     * @param response
     * @param chain
     * @throws IOException
     * @throws ServletException
     */
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse res = (HttpServletResponse) response;
        res.setHeader("Access-Control-Allow-Origin", "*");
        res.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT");
        res.setHeader("Access-Control-Max-Age", "3600");
        res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, Accept, x-requested-with, Cache-Control");
        chain.doFilter(request, res);
    }

    @Override
    public void destroy() {

    }
}

我通过一个简单的$http调用访问代码

$scope.login = function() {
  $http({
    method: 'GET',
    url: 'https://myservice.mydomain.com:8095/v1/users/login',
    headers: {
      'Authorization': 'Basic ' + btoa("username:password")
    }
  })
    .then(successCallback);
};

我认为将CORS过滤器放在安全性之前只意味着将CORS头添加到每个请求中，这看起来并不是什么安全漏洞，因为我在头中不发送敏感数据，授权头除外

---

我是在想，还是有什么我看不见的东西？

我认为这很好。事实上，当您的JavaScript代码发布到另一个来源的资源时，浏览器将发出飞行前请求（

OPTIONS

verb），而不使用

authorization

标题

如果您的身份验证代码在CORS处理程序之前运行，它必须对此请求进行例外处理，以避免在飞行前返回

401 Unauthorized