前后端分离之跨域问题

Response to preflight request doesn‘t pass access control check: 
No ‘Access-Control-Allow-Origin‘ header is present on the requested resource. 
Origin ‘null‘ is therefore not allowed access. The response had HTTP status code 403.

Access-Control-Allow-Origin: http://abc.com  
Access-Control-Max-Age: 3600
Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE, PUT
Access-Control-Allow-Headers: x-requested-with

"Access-Control-Allow-Origin"表明它允许 "http://abc.com" 发起跨域请求,如果允许所有域名则填写“*”
"Access-Control-Max-Age"表明在3600秒内，不需要再发送预检验请求，可以缓存该结果（上面的资料上我们知道CROS协议中，`一个AJAX请求被分成了第一步的OPTION预检测请求和正式请求`）
"Access-Control-Allow-Methods"表明它允许POST, GET, OPTIONS, DELETE, PUT的外域请求
"Access-Control-Allow-Headers"表明它允许跨域请求包含x-requested-with头

package com.test.crossorigin;

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletResponse;
import org.springframework.stereotype.Component;

@Component
public class SimpleCORSFilter implements Filter {

    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) res;
        response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "x-requested-with,Authorization");
        chain.doFilter(req, res);
    }

    public void init(FilterConfig filterConfig) {}

    public void destroy() {}

}

<filter> 
    <filter-name>cors</filter-name> 
    <filter-class>"CLASS_PATH".SimpleCORSFilter</filter-class> 
</filter> 
<filter-mapping> 
    <filter-name>cors</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping>