@Configuration
public class CorsConfig implements WebMvcConfigurer {

  @Override
  public void addCorsMappings(CorsRegistry registry) {
    registry.addMapping("/**")
      .allowedOrigins("*")
      .allowCredentials(true)
      .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
      .maxAge(3600);
  }
}

public class CorsRegistry {

  private final List<CorsRegistration> registrations = new ArrayList<>();

  public CorsRegistration addMapping(String pathPattern) {
   CorsRegistration registration = new CorsRegistration(pathPattern);
   this.registrations.add(registration);
   return registration;
  }
  
  protected Map<String, CorsConfiguration> getCorsConfigurations() {
   Map<String, CorsConfiguration> configs = new LinkedHashMap<>(this.registrations.size());
   for (CorsRegistration registration : this.registrations) {
     configs.put(registration.getPathPattern(), registration.getCorsConfiguration());
   }
   return configs;
  }

} 

public class CorsRegistration {
  //傳入的路徑
  private final String pathPattern;
  //配置信息實(shí)體類
  private final CorsConfiguration config;
  //構(gòu)造方法
  public CorsRegistration(String pathPattern) {
   this.pathPattern = pathPattern;
   //原生注釋看到了一個(gè) @CrossOrigin 這個(gè)注解，待會(huì)看看是什么
   // Same implicit default values as the @CrossOrigin annotation + allows simple methods
   this.config = new CorsConfiguration().applyPermitDefaultValues();
  }
  //允許哪些源網(wǎng)站訪問，默認(rèn)所有
  public CorsRegistration allowedOrigins(String... origins) {
   this.config.setAllowedOrigins(Arrays.asList(origins));
   return this;
  }
  //允許何種方式訪問，默認(rèn)簡(jiǎn)單方式，即：GET，HEAD，POST
  public CorsRegistration allowedMethods(String... methods) {
   this.config.setAllowedMethods(Arrays.asList(methods));
   return this;
  }
  //設(shè)置訪問header，默認(rèn)所有
  public CorsRegistration allowedHeaders(String... headers) {
   this.config.setAllowedHeaders(Arrays.asList(headers));
   return this;
  }
  //設(shè)置response headers，默認(rèn)沒有（什么都不設(shè)置）
  public CorsRegistration exposedHeaders(String... headers) {
   this.config.setExposedHeaders(Arrays.asList(headers));
   return this;
  }
  //是否瀏覽器應(yīng)該發(fā)送credentials，例如cookies Access-Control-Allow-Credentials
  public CorsRegistration allowCredentials(boolean allowCredentials) {
   this.config.setAllowCredentials(allowCredentials);
   return this;
  }
  //設(shè)置等待時(shí)間，默認(rèn)1800秒
  public CorsRegistration maxAge(long maxAge) {
   this.config.setMaxAge(maxAge);
   return this;
  }

  protected String getPathPattern() {
   return this.pathPattern;
  }

  protected CorsConfiguration getCorsConfiguration() {
   return this.config;
  }

}

@Target({ ElementType.METHOD, ElementType.TYPE })
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface CrossOrigin {

  /** @deprecated as of Spring 5.0, in favor of {@link CorsConfiguration#applyPermitDefaultValues} */
  @Deprecated
  String[] DEFAULT_ORIGINS = { "*" };

  /** @deprecated as of Spring 5.0, in favor of {@link CorsConfiguration#applyPermitDefaultValues} */
  @Deprecated
  String[] DEFAULT_ALLOWED_HEADERS = { "*" };

  /** @deprecated as of Spring 5.0, in favor of {@link CorsConfiguration#applyPermitDefaultValues} */
  @Deprecated
  boolean DEFAULT_ALLOW_CREDENTIALS = false;

  /** @deprecated as of Spring 5.0, in favor of {@link CorsConfiguration#applyPermitDefaultValues} */
  @Deprecated
  long DEFAULT_MAX_AGE = 1800

  /**
  * Alias for {@link #origins}.
  */
  @AliasFor("origins")
  String[] value() default {};

  @AliasFor("value")
  String[] origins() default {};

  String[] allowedHeaders() default {};

  String[] exposedHeaders() default {};

  RequestMethod[] methods() default {};

  String allowCredentials() default "";

  long maxAge() default -1;
}