cros控制提交

zhijiayun-gateway/src/main/java/com/xuekairui/gateway/filter/RateLimitFilter.java

@@ -46,6 +46,12 @@ public class RateLimitFilter extends OncePerRequestFilter {
             @NonNull FilterChain filterChain
     ) throws ServletException, IOException {
 
+        // CORS 预检请求（OPTIONS）不需要限流，直接放行
+        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+
         if (!properties.getRateLimit().isEnabled()) {
             filterChain.doFilter(request, response);
             return;

zhijiayun-user/src/main/java/com/xuekairui/user/config/SecurityConfig.java

@@ -106,10 +106,16 @@ public class SecurityConfig {
     @Bean
     public CorsConfigurationSource corsConfigurationSource() {
         CorsConfiguration configuration = new CorsConfiguration();
-        configuration.setAllowedOrigins(List.of("*"));
-        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
+        // allowedOriginPatterns 会回显请求中的 Origin（不会发 *），
+        // 比 allowedOrigins 更安全且与代理服务器兼容
+        configuration.setAllowedOriginPatterns(List.of("*"));
+        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"));
         configuration.setAllowedHeaders(List.of("*"));
-        configuration.setExposedHeaders(List.of("Authorization"));
+        // 允许前端读取的响应头
+        configuration.setExposedHeaders(List.of("Authorization", "X-Request-Id"));
+        // 注意：不设置 allowCredentials，因为前端通过 Authorization 头传递 JWT，
+        // 不依赖 Cookie。如果 Nginx 反向代理添加了 Access-Control-Allow-Origin: *，
+        // allowCredentials=true 会导致浏览器拒绝该组合（CORS 规范禁止）。
         configuration.setMaxAge(3600L);
 
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();

zhijiayun-user/src/main/java/com/xuekairui/user/security/JwtAuthenticationFilter.java

@@ -42,6 +42,12 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
             @NonNull FilterChain filterChain
     ) throws ServletException, IOException {
 
+        // CORS 预检请求（OPTIONS）不需要认证，直接放行
+        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+
         String token = extractToken(request);
 
         if (token != null && SecurityContextHolder.getContext().getAuthentication() == null) {