码头、印前飞行和阿贾克斯
2022-09-03 16:16:36
以编程方式设置一个Jetty服务器,我尝试通过ajax和xmlHttpRequest访问。未经授权,呼叫工作正常,但与,我得到401未经授权。任何建议。
Javascript 调用如下所示(缩短):
var auth = base64encode('name','pwd');
try{
var xmlhttp = new XMLHttpRequest();
xmlhttp.open("POST", "http://127.0.0.1:5563/ajax/index.html", true);
xmlhttp.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
xmlhttp.setRequestHeader('Authorization', auth);
xmlhttp.withCredentials = 'true';
xmlhttp.send();
xmlDoc = xmlhttp.responseXML;
$('#textResult').val(xmlDoc);
}
catch(e){
$('#textResult').val('CATCH: ' + e);
}
服务器代码看起来像这样(甚至更短)
class CallObject extends HttpServlet {
//...
@Override
public void doOptions(HttpServletRequest request, HttpServletResponse response)
throws IOException
{
response.setHeader("Access-Control-Allow-Origin", "*");
response.setHeader("Access-Control-Allow-Methods",
"GET, POST, HEAD, OPTIONS");
response.setHeader("Access-Control-Allow-Credentials", "true");
response.setHeader("Access-Control-Allow-Headers",
"X-Requested-With, authorization");
}
//...
}
class WebServer{
//...
SecurityHandler sh = null;
if (logins != null && logins.length > 0){
String role = "user";
sh = new SecurityHandler();
Constraint constraint = new Constraint();
constraint.setName(Constraint.__BASIC_AUTH);
constraint.setRoles(new String[]{role});
constraint.setAuthenticate(true);
ConstraintMapping cm = new ConstraintMapping();
cm.setConstraint(constraint);
cm.setPathSpec("/*");
HashUserRealm hur = new HashUserRealm();
hur.setName("eMark Web Server");
for (int i = 0; i < logins.length; i++) {
String user_name = logins[i][0];
String password = logins[i][1];
hur.put(user_name, password);
hur.addUserToRole(user_name, role);
}
sh.setUserRealm(hur);
sh.setConstraintMappings(new ConstraintMapping[]{cm});
_server.setHandlers(
new Handler[]{sh, _contexts, new DefaultHandler()});
}
//...
}