问Rest调用从Heroku角前端调用到heroku springboot引导后端时返回403

EN

@Configruation
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter{

public String crossOriginAllowedHeaders="header1,header2, *" ;
public String crossOriginAllowedSites="site1,site2, * ";

  @Override
    protected void configure(HttpSecurity http) throws Exception {
     )
      http.cors()
           .and()
           .csrf()
           .disable();

             ............
             ...........
        .and()
             .headers()
             .frameOptions()
             .sameOrigin().addHeaderWriter((request,response)->{
                                                 response.setHeader("Cache-Control","no-cache, no-store, max-age=0, must-revalidate, private");
                                                 response.setHeader("Pragma","no-cache");
                                                 response.setHeader("Access-Control-Allow-Origin",this.crossOriginAllowedSites);
                                             })



}


 @Bean
    @Order(Ordered.HIGHEST_PRECEDENCE)
    protected CorsFilter crossFilter() {
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        CorsConfiguration config = new CorsConfiguration();
        config.setAllowCredentials(false);
        config.setAllowedHeaders(Arrays.asList(crossOriginAllowedHeaders.split(",")));
        config.setAllowedOrigins(Arrays.asList(crossOriginAllowedSites.split(",")));
        //config.setAllowedHeaders("*"); whitelist all sites
        //config.setAllowedOrigins("*"); whitelist all headers
        config.addAllowedMethod(HttpMethod.OPTIONS);
        config.addAllowedMethod(HttpMethod.GET);
        config.addAllowedMethod(HttpMethod.POST);
        config.addAllowedMethod(HttpMethod.PUT);
        config.addAllowedMethod(HttpMethod.DELETE);
        config.addExposedHeader("Authorization");
        config.setMaxAge(new Long(1800));

        source.registerCorsConfiguration("/api/**", config);
        source.registerCorsConfiguration(MANAGEMENT, config);
        source.registerCorsConfiguration("/v2/api-docs", config);
        source.registerCorsConfiguration("/**", config);

        return new CorsFilter(source);
    }

}