/**

 * 跨域允许

 */

@Configuration

public class CorsConfig {

    @Bean

    public WebFilter corsFilter() {

        return (ServerWebExchange ctx, WebFilterChain chain) -> {

            ServerHttpRequest request = ctx.getRequest();

            if (CorsUtils.isCorsRequest(request)) {

                ServerHttpResponse response = ctx.getResponse();

                HttpHeaders headers = response.getHeaders();

                headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "*");

                headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*");

                headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "");

                headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");

                headers.add(HttpHeaders.ACCESS_CONTROL_EXPOSE_HEADERS, "*");

                headers.add(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");

                if (request.getMethod() == HttpMethod.OPTIONS) {

                    response.setStatusCode(HttpStatus.OK);

                    return Mono.empty();

                }

            }

            return chain.filter(ctx);

        };

    }

}

参考博客：https://blog.csdn.net/a294634473/article/details/90715903

- DedupeResponseHeader=Access-Control-Allow-Credentials Access-Control-Allow-Origin Access-Control-Allow-Methods Access-Control-Allow-Headers Vary

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.web.cors.CorsConfiguration;

import org.springframework.web.cors.reactive.CorsWebFilter;

import org.springframework.web.util.pattern.PathPatternParser;

@Configuration

public class GwCorsFilter {

    @Bean

    public CorsWebFilter corsFilter() {

        CorsConfiguration config = new CorsConfiguration();

        config.setAllowCredentials(true); // 允许cookies跨域

        config.addAllowedOrigin("*");// #允许向该服务器提交请求的URI，*表示全部允许，在SpringMVC中，如果设成*，会自动转成当前请求头中的Origin

        config.addAllowedHeader("*");// #允许访问的头信息,*表示全部

        config.addAllowedMethod("*");// 允许提交请求的方法类型，*表示全部允许

        config.setMaxAge(18000L);// 预检请求的缓存时间（秒），即在这个时间段里，对于相同的跨域请求不会再预检了

        org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource source =

                new org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource(new PathPatternParser());

        source.registerCorsConfiguration("/**", config);

        return new CorsWebFilter(source);

    }

}

import java.util.Arrays;

import java.util.List;

import java.util.stream.Collectors;

import org.springframework.cloud.gateway.filter.GatewayFilter;

import org.springframework.cloud.gateway.filter.GatewayFilterChain;

import org.springframework.cloud.gateway.filter.factory.AbstractGatewayFilterFactory;

import org.springframework.http.HttpHeaders;

import org.springframework.web.server.ServerWebExchange;

import lombok.extern.slf4j.Slf4j;

import reactor.core.publisher.Mono;

/*

Use case: Both your legacy backend and your API gateway add CORS header values. So, your consumer ends up with

          Access-Control-Allow-Credentials: true, true

          Access-Control-Allow-Origin: https://musk.mars, https://musk.mars

(The one from the gateway will be the first of the two.) To fix, add

          DedupeResponseHeader=Access-Control-Allow-Credentials Access-Control-Allow-Origin

Configuration parameters:

- name

    String representing response header names, space separated. Required.

- strategy

    RETAIN_FIRST - Default. Retain the first value only.

    RETAIN_LAST - Retain the last value only.

    RETAIN_UNIQUE - Retain all unique values in the order of their first encounter.

Example 1

      default-filters:

      - DedupeResponseHeader=Access-Control-Allow-Credentials

Response header Access-Control-Allow-Credentials: true, false

Modified response header Access-Control-Allow-Credentials: true

Example 2

      default-filters:

      - DedupeResponseHeader=Access-Control-Allow-Credentials, RETAIN_LAST

Response header Access-Control-Allow-Credentials: true, false

Modified response header Access-Control-Allow-Credentials: false

Example 3

      default-filters:

      - DedupeResponseHeader=Access-Control-Allow-Credentials, RETAIN_UNIQUE

Response header Access-Control-Allow-Credentials: true, true

Modified response header Access-Control-Allow-Credentials: true

 */

/**

 * @author Vitaliy Pavlyuk

 */

@Slf4j

public class DedupeResponseHeaderGatewayFilterFactory extends

        AbstractGatewayFilterFactory<DedupeResponseHeaderGatewayFilterFactory.Config> {

    private static final String STRATEGY_KEY = "strategy";

    public DedupeResponseHeaderGatewayFilterFactory() {

        super(Config.class);

    }

    @Override

    public List<String> shortcutFieldOrder() {

        return Arrays.asList(NAME_KEY, STRATEGY_KEY);

    }

    @Override

    public GatewayFilter apply(Config config) {

        return new GatewayFilter() {

            @Override

            public Mono<Void> filter(ServerWebExchange exchange,

                    GatewayFilterChain chain) {

                return chain.filter(exchange).then(Mono.fromRunnable(

                        () -> dedupe(exchange.getResponse().getHeaders(), config)));

            }

        };

    }

    public enum Strategy {

        /**

         * Default: Retain the first value only.

         */

        RETAIN_FIRST,

        /**

         * Retain the last value only.

         */

        RETAIN_LAST,

        /**

         * Retain all unique values in the order of their first encounter.

         */

        RETAIN_UNIQUE

    }

    void dedupe(HttpHeaders headers, Config config) {

        String names = config.getName();

        Strategy strategy = config.getStrategy();

        if (headers == null || names == null || strategy == null) {

            return;

        }

        for (String name : names.split(" ")) {

            dedupe(headers, name.trim(), strategy);

        }

    }

    private void dedupe(HttpHeaders headers, String name, Strategy strategy) {

        List<String> values = headers.get(name);

        log.info("{}={}",name,values);

        if (values == null || values.size() <= 1) {

            return;

        }

        switch (strategy) {

        case RETAIN_FIRST:

            headers.set(name, values.get(0));

            break;

        case RETAIN_LAST:

            headers.set(name, values.get(values.size() - 1));

            break;

        case RETAIN_UNIQUE:

            headers.put(name, values.stream().distinct().collect(Collectors.toList()));

            break;

        default:

            break;

        }

    }

    public static class Config extends AbstractGatewayFilterFactory.NameConfig {

        private Strategy strategy = Strategy.RETAIN_FIRST;

        public Strategy getStrategy() {

            return strategy;

        }

        public Config setStrategy(Strategy strategy) {

            this.strategy = strategy;

            return this;

        }

    }

}