vue react 403 forbidden cors

response.setHeader("Access-Control-Allow-Origin", "*");
        response.setHeader("Access-Control-Allow-Methods", "GET,POST,PUT,DELETE,OPTIONS");
        response.setHeader("Access-Control-Allow-Headers", "Authorization,Content-type,Accept,X-Requested-With,sid,mycustom,smuser,Origin");
        response.setHeader("Access-Control-Max-Age", "3600");
        response.setHeader("Access-Control-Allow-Credentials", "true");
        
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        if ( httpRequest.getMethod().equals("OPTIONS") ) {
            httpResponse.setStatus(HttpServletResponse.SC_OK);
            return;
        }
        filterChain.doFilter(request, response);

关键

if ( httpRequest.getMethod().equals("OPTIONS") ) {
            httpResponse.setStatus(HttpServletResponse.SC_OK);
            return;
        }

OPTIONS方式是预请求方式，必须设置response status为200并立即返回