public void doFilter(ServletRequest servletRequest,ServletResponse servletResponse,FilterChain filterChain) throws IOException,ServletException {

HttpServletResponse res = (HttpServletResponse) servletResponse;

HttpServletRequest request=(HttpServletRequest)servletRequest;

res.setContentType("textml;charset=UTF-8");

res.setHeader("Access-Control-Allow-Origin",request.getHeader("Origin"));

res.setHeader("Access-Control-Allow-Methods","POST,GET,OPTIONS,DELETE");

res.setHeader("Access-Control-Max-Age","0");

res.setHeader("Access-Control-Allow-Headers","Origin,No-Cache,X-Requested-With,If-Modified-Since,Pragma,Last-Modified,Cache-Control,Expires,Content-Type,X-E4M-With,userId,token");

res.setHeader("Access-Control-Allow-Credentials","true");

res.setHeader("XDomainRequestAllowed","1");

filterChain.doFilter(servletRequest,servletResponse);

}

在ajax 请求是也要加相应的东西

$.ajax({

url:url,

//加上这句话

xhrFields: {

withCredentials: true

},

crossDomain: true,

success:function(result){

alert("test");

},

error:function(){

}

});

这样我们再跨域测试的时候，就会发现我们的sessionId是一样的了，这样就实现了跨域并且保证在同一个session下。