记录一个问题

在学习shiro+cas 前后端分离单点登录过程中，遇到跨域重定向的问题

其中登录后，在访问cas客户端的controller时，浏览器出现了这个跨域问题

Access to XMLHttpRequest at 'http://127.0.0.1:18081/blog-backend/shiro/hello' (redirected from 'http://localhost:28080/blog-backend/blog/save') from origin 'http://localhost:28080' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'http://localhost:28080' that is not equal to the supplied origin.

cas客户端的跨域访问配置

package com.jsong.wiki.backend.interceptor;

import lombok.extern.log4j.Log4j2;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@Component
@Log4j2
public class CommonInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        log.info("拦截器");
//        response.setHeader("Access-Control-Allow-Origin", "null");
        response.setHeader("Access-Control-Allow-Origin", "http://localhost:28080");
        if (request.getMethod().equals("OPTIONS")) {
            response.addHeader("Access-Control-Allow-Methods", "GET,HEAD,POST,PUT,DELETE,TRACE,OPTIONS,PATCH");
            response.addHeader("Access-Control-Allow-Headers", "Content-Type,Accept,Authorization");
        }
        return true;
    }
}

浏览器的请求源是http://localhost:28080
cas客户端配置的"Access-Control-Allow-Origin", “http://localhost:28080”
但是还是报源不同，不知道为什么

cas客户端配置改成
response.setHeader(“Access-Control-Allow-Origin”, “null”)
就没有问题了，不知道为什么
太菜了，还是没搞懂cas的原理，先记录一下问题

最后cas客户端配置

package com.jsong.wiki.backend.interceptor;

import lombok.extern.log4j.Log4j2;
import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

@Component
@Log4j2
public class CommonInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        log.info("拦截器");
        response.setHeader("Access-Control-Allow-Origin", "null");
//        response.setHeader("Access-Control-Allow-Origin", "http://localhost:28080");
        if (request.getMethod().equals("OPTIONS")) {
            response.addHeader("Access-Control-Allow-Methods", "GET,HEAD,POST,PUT,DELETE,TRACE,OPTIONS,PATCH");
            response.addHeader("Access-Control-Allow-Headers", "Content-Type,Accept,Authorization");
        }
        return true;
    }
}