public class ShiroSessionProvider implements SessionProvider {

	public HttpServletRequest filter(HttpServletRequest req, HttpServletResponse resp, ServletContext servletContext) {
		if ("OPTIONS".equalsIgnoreCase(req.getMethod())) {
			resp.addHeader("Access-Control-Allow-Origin", "*");
			resp.addHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Key");
		}
		if (req instanceof ShiroHttpServletRequest)
			return req;
		return new ShiroHttpServletRequest(req, servletContext, true);
	}

这里的if ("OPTIONS".equalsIgnoreCase(req.getMethod())) {
resp.addHeader("Access-Control-Allow-Origin", "*");
resp.addHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Key");
}

麻烦问下兽总，是什么作用呢，允许所有系统跨域访问？ 我不希望本系统支持跨域或者说对所有其他系统支持跨域，把这个*改成某个指定域就行了吧？
还是也需要在nginx里配置下add header？