package com.example.demo.config;

import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
import org.springframework.http.HttpStatus;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

// 过滤OPTIONS请求，继承shiro的form表单过滤器，对OPTIONS请求进行过滤，复杂请求中OPTIONS请求不带token信息，不能通过shiro认证
public class CORSAuthenticationFilter extends FormAuthenticationFilter {

    private static final String REQUEST_TYPE = "OPTIONS";

    public CORSAuthenticationFilter(){
        super();
    }

    @Override
    public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue){
        if (((HttpServletRequest) request).getMethod().toUpperCase().equals(REQUEST_TYPE)) {
            return true;
        }
        return super.isAccessAllowed(request, response, mappedValue);
    }

    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception{
        HttpServletResponse res = (HttpServletResponse)response;
        HttpServletRequest req = (HttpServletRequest)request;
        res.addHeader("Access-Control-Allow-Origin", req.getHeader("origin"));
        setHeader(req,res);
        res.setStatus(HttpServletResponse.SC_OK);
        res.setCharacterEncoding("UTF-8");
        return false;
    }
    // 为response设置header，实现跨域
    private void setHeader(HttpServletRequest request,HttpServletResponse response){
        // 跨域的header设置
        response.setHeader("Access-control-Allow-Origin", request.getHeader("Origin"));
        response.setHeader("Access-Control-Allow-Methods", request.getMethod());
        response.setHeader("Access-Control-Allow-Credentials", "true");
        response.setHeader("Access-Control-Allow-Headers", request.getHeader("Access-Control-Request-Headers"));
        // 防止乱码，适用于传输JSON数据
        // Content-Type, Content-Length, Authorization, Accept, X-Requested-With, yourHeaderField
        response.setHeader("Content-Type","application/json;charset=UTF-8");
        response.setStatus(HttpStatus.OK.value());
    }
}
