1.定義過濾器介面Filter的實現類，實現類中修改respone的頭資訊，把 “Access-Control-Allow-Origin” 的域名修改問請求方的域名，如下:

package filter;  

import java.io.IOException;  

import javax.servlet.Filter;  
import javax.servlet.FilterChain;  
import javax.servlet.FilterConfig;  
import javax.servlet.ServletException;  
import javax.servlet.ServletRequest;  
import
 
 javax.servlet.ServletResponse;  
import javax.servlet.http.HttpServletResponse;  


public class CORSFilter implements Filter {  

    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {  
        HttpServletResponse response = (HttpServletResponse) res;  
        response.setHeader("Access-Control-Allow-Origin"
 
, "<請求方域名如:http://www.sohu.com>");  
        response.setHeader("Access-Control-Allow-Methods", "POST, GET, PUT, OPTIONS, DELETE");  
        response.setHeader("Access-Control-Max-Age", "3600");  
        response.setHeader("Access-Control-Allow-Headers", "x-requested-with, Content-Type");  
        response.setHeader("Access-Control-Allow-Credentials"
 
, "true");  
        chain.doFilter(req, res);  
    }  

    public void init(FilterConfig filterConfig) {}  

    public void destroy() {}  

}

2.在web.xml中配置此過濾器:

<filter>  
    <filter-name>CORSFilter</filter-name>  
    <filter-class>com.exiao.platform.api.supplier.filter.CORSFilter</filter-class>  
</filter> 

為了防止CSRF攻擊：

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        String curOrigin = request.getHeader("Origin");
        LOGGER.info("當前訪問來源是：{}", curOrigin);
        // 從列表中獲取，可以將資料放入快取
        if (corsOriginList.contains(curOrigin)) {
            response.setHeader("Access-Control-Allow-Origin", curOrigin);
        } else {
            return ;
        }

        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Headers", "x-requested-with");
        chain.doFilter(req, res);
    }