public class WebSecurityConfig extends WebSecurityConfigurerAdapter {    

@Override    

protected void configure(HttpSecurity http) throws Exception {

… .

and()   

.cors()// ***重点

.and()   

.csrf().disable(); …    

}