配置安全配置时，我所缺少的只是AddFilterBefore。
所以最终版本是：
@EnableWebMvcSecurity@Configurationpublic class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired protected void registerAuthentication(AuthenticationManagerBuilder auth) throws Exception { auth.inMemoryAuthentication() .withUser("user").password("password").roles("USER"); } @Override protected void configure(HttpSecurity http) throws Exception { http .addFilterBefore(new CORSFilter(), ChannelProcessingFilter.class) .formLogin() .loginPage("/login") .and() .authorizeRequests() .anyRequest().authenticated();并从中删除CORSFilter
WebAppInitializer
