域名CORS预检失败

yd-auth-core/src/main/java/com/yd/auth/core/config/SecurityConfig.java

@@ -7,6 +7,7 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -16,6 +17,12 @@ import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+
+import java.util.Arrays;
+import java.util.Collections;
 
 @Configuration
 @EnableWebSecurity
@@ -56,12 +63,14 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         http
+                .cors().and()  // 1.开启 CORS 支持
                 .csrf().disable()
                 .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)
                 .and()
                 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                 .and()
                 .authorizeRequests()
+                .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()  // 2.放行预检请求
                 .antMatchers(
                         "/auth/login",
                         "/auth/register",
@@ -107,4 +116,18 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
                 .and()
                 .addFilterBefore(authenticationFilter, UsernamePasswordAuthenticationFilter.class);
     }
+
+    @Bean
+    public CorsConfigurationSource corsConfigurationSource() {
+        CorsConfiguration configuration = new CorsConfiguration();
+        configuration.setAllowedOriginPatterns(Collections.singletonList("*")); // Spring 5.3+ 支持回显 Origin
+        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"));
+        configuration.setAllowedHeaders(Collections.singletonList("*"));
+        configuration.setAllowCredentials(true);
+        configuration.setMaxAge(3600L);
+
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", configuration);
+        return source;
+    }
 }

yd-auth-core/src/main/java/com/yd/auth/core/security/JwtAuthenticationEntryPoint.java

@@ -21,6 +21,12 @@ public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {
         log.info("JwtAuthenticationEntryPoint commence:{}","未经授权的访问");
         // 设置响应类型为JSON
         response.setContentType("application/json;charset=UTF-8");
+        // 兜底：回显 Origin，避免前端拿不到 CORS 头而只看到笼统错误
+        String origin = request.getHeader("Origin");
+        if (origin != null) {
+            response.setHeader("Access-Control-Allow-Origin", origin);
+            response.setHeader("Access-Control-Allow-Credentials", "true");
+        }
         // 直接设置401状态码
         response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
         // 返回JSON格式的错误信息

yd-auth-core/src/main/java/com/yd/auth/core/security/JwtAuthenticationFilter.java

@@ -52,6 +52,12 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
                                     HttpServletResponse response,
                                     FilterChain filterChain) throws ServletException, IOException {
 
+        // 关键：预检请求不需要认证，直接放行，避免进入 Token 解析逻辑
+        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
+            filterChain.doFilter(request, response);
+            return;
+        }
+
         // 1. 从HTTP请求中解析JWT令牌（通常从Authorization头获取）
         String token = resolveToken(request);
         log.info("从HTTP请求中解析JWT令牌（通常从Authorization头获取）:{}",token);

yd-common/src/main/java/com/yd/common/utils/RandomStringGenerator.java

@@ -60,9 +60,10 @@ public class RandomStringGenerator {
 //        String random32 = generate(32, false);
 //        System.out.println("32位: " + random32);
 
-        for (int i = 0; i < 9; i++) {
-            System.out.println(generateBizId16("user_sign"));
-        }
+//        for (int i = 0; i < 9; i++) {
+//            System.out.println(generateBizId16("user_sign"));
+//        }
 
+        System.out.println(generateBizId16("agent_tutoring_relation"));
     }
 }