When allowCredentials is true, allowedOrigins cannot contain the special value "*" since that cannot be set o

当allowCredentials为true时，allowedOrigins不能包含特殊值"*"，因为它不能设置在"Access-Control-Allow-Origin"响应头中。要允许凭据到一组来源，必须显式列出它们或考虑使用"allowedOriginPatterns"代替。

这个错误通常在Java应用程序中处理CORS（跨域资源共享）时出现。CORS是一种安全机制，用于限制跨域请求。当allowCredentials设置为true时，允许源的值不能为"*"，而是需要明确指定允许的来源。

在修改方式中，将allowedOrigins修改为allowedOriginPatterns即可解决此问题。修改后的代码如下：

@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOriginPatterns("*")
.allowedMethods("GET", "HEAD", "POST", "PUT", "DELETE", "OPTIONS")
.allowCredentials(true)
.maxAge(3600)
.allowedHeaders("*");
}

相关问题

When allowCredentials is true, allowedOrigins cannot contain the special value “*“ since that canno

t be used in conjunction with credentials. Instead, you must specify the exact origins allowed to access the resource with credentials. This is because the Access-Control-Allow-Origin header, which is used to indicate allowed origins, must match the Origin header sent by the client. When credentials are involved, the Origin header is not sent if the allowed origins are set to “*“, which prevents the server from verifying the origin of the request. Therefore, to use credentials, you must specify the exact allowed origins.

when allowcredentials is true, allowedorigins cannot contain the special value "*" since that cannot be set on the "access-control-allow-origin" response header. to allow credentials to a set of origins, list them explicitly or consider using "allowedori

当allowcredentials为true时，allowedorigins不能包含特殊值"*"，因为该值无法在"access-control-allow-origin"响应头中设置。要允许特定的来源访问凭据，需要明确列出这些来源，或者考虑使用"allowedori"来设置。