.htaccess中的头设置Access-Control-Allow-Origin不起作用

Question

我无法弄清楚为什么我的.htaccess标题设置不起作用.

我的.htaccess文件内容:

Header set Access-Control-Allow-Origin *
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
Header always set Access-Control-Allow-Headers "*"
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^(.*)$ index.php [QSA,L]

但是当我删除Header并添加它们时,index.php一切正常.

header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: PUT, GET, POST, DELETE, OPTIONS");
header("Access-Control-Allow-Headers: *");

我错过了什么？

Answer 1

这应该工作:

Header add Access-Control-Allow-Origin "*"
Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

Answer 2

只是为了记录,我遇到了完全相同的问题,没有一个答案奏效.

我使用了一个头文件检查工具:http://www.webconfs.com/http-header-check.php

我正在测试我的IP(http://192.0.2.1/upload),回来的是以下内容:

HTTP/1.1 301 Moved Permanently => 
Date => Sat, 10 Jan 2015 04:03:35 GMT
Server => Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
Location => http://192.0.2.1/upload/
Content-Length => 380
Connection => close
Content-Type => text/html; charset=iso-8859-1

发生了重定向,并且AJAX请求不遵循/遵循重定向.

事实证明这是域名末尾缺少的斜杠(http://192.0.2.1/upload /)

我在最后用斜线再次测试,我在下面得到了这个.在脚本中也添加了一个斜杠,它现在正在工作.

HTTP/1.1 200 OK => 
Date => Sat, 10 Jan 2015 04:03:53 GMT
Server => Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By => PHP/5.3.8
Access-Control-Allow-Origin => *
Access-Control-Allow-Methods => PUT, GET, POST, DELETE, OPTIONS
Access-Control-Allow-Headers => *
Content-Length => 1435
Connection => close
Content-Type => text/html

使用此工具来测试标题是否良好以及对正在发生的事情进行故障排除.

Answer 3

我在GoDaddy上有一个共享主机.我也需要回答这个问题,在搜索之后我发现它是可能的.

我写了一个.htaccess文件,把它放在与我的操作页面相同的文件夹中.以下是.htaccess文件的内容:

Header add Access-Control-Allow-Origin "*"
Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

这是我的ajax电话:

    $.ajax({
        url: 'http://www.mydomain.com/myactionpagefolder/gbactionpage.php',  //server script to process data
        type: 'POST',
        xhr: function() {  // custom xhr
            myXhr = $.ajaxSettings.xhr();
            if(myXhr.upload){ // check if upload property exists
                myXhr.upload.addEventListener('progress',progressHandlingFunction, false); // for handling the progress of the upload
            }
            return myXhr;
        },
        //Ajax events
        beforeSend: beforeSendHandler,
        success: completeHandler,
        error: errorHandler,
        // Form data
        data: formData,
        //Options to tell JQuery not to process data or worry about content-type
        cache: false,
        contentType: false,
        processData: false
    });

请参阅此文章以供参考:

.htaccess中的头设置Access-Control-Allow-Origin不起作用

Answer 4

小心:

 Header add Access-Control-Allow-Origin "*"

根本不明智地授予每个人访问权限.最好只允许知道可信主机列表......

Header add Access-Control-Allow-Origin "http://aaa.example"
Header add Access-Control-Allow-Origin "http://bbb.example"
Header add Access-Control-Allow-Origin "http://ccc.example"

问候,

Answer 5

我激活了Apache模块头a2enmod头,问题已经解决了.

Answer 6

在外部根文件夹的 .htaccess 中尝试此操作

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "*"
</IfModule>

这样做要小心Header add Access-Control-Allow-Origin "*"向每个人授予访问权限是不明智的。我认为你应该使用：

<IfModule mod_headers.c>
    Header set Access-Control-Allow-Origin "http://example.com"
</IfModule>