从浏览器请求时,CORS响应标头在Spray中不起作用

Question

我试图在Spray服务器上实现CORS支持(版本1.1-20131011,其中已经支持cors头).

目前,服务器代码如下所示:

trait DefaultCORSDirectives { this: Directives =>
  def defaultCORSHeaders = respondWithHeaders(
      `Access-Control-Allow-Origin`(AllOrigins),
      `Access-Control-Allow-Methods`(HttpMethods.GET, HttpMethods.POST, HttpMethods.OPTIONS, HttpMethods.DELETE,
      HttpMethods.CONNECT, HttpMethods.DELETE, HttpMethods.HEAD, HttpMethods.PATCH, HttpMethods.PUT, HttpMethods.TRACE),
      `Access-Control-Allow-Headers`("Origin, X-Requested-With, Content-Type, Accept, Accept-Encoding, Accept-Language, Host," +
    " Referer, User-Agent, Overwrite, Destination, Depth, X-Token, X-File-Size, If-Modified-Since, X-File-Name, Cache-Control"),
      `Access-Control-Allow-Credentials`(true),
      `Access-Control-Max-Age`(3600)
    )
}

并像这样使用

  defaultCORSHeaders {
      options {
        complete {
          StatusCodes.OK
        }
      } ~
      post {
        path("path") {
          //response
      }
   }

使用curl时,POST和OPTIONS方法的响应都是预期的.但是,从浏览器,我得到Access不允许使用Access-Control-Allow-Origin(Chrome)或错误415不支持的媒体类型(Firefox),似乎根本不发送POST请求.

请求的jQuery代码如下:

$(document).ready(function () {
        $.post(url,
            {
               'params': "params",
            },
            function (data) {
                //handle response
            }
    );
});

我已经阅读了CORS规范和我能找到的所有资源,尝试了Access-Control-Allow-headers的任何可能组合(有和没有Access-Control-Allow-Credentials,Access-Control-Allow-Headers的不同内容和Access-Control-Allow-Methods,Access-Control-Allow-Origin设置为*或单个Origin等.我还尝试从磁盘(Origin null),webserver(Origin localhost:8888)和远程服务器(Origin标准url)运行脚本,因为某些浏览器显然阻止了具有本地原点的请求,但总是相同的否定结果.

任何帮助如何使这项工作将不胜感激.

Answer 1

如果您在 API 中有授权，则必须在 中包含 Authorization 标头Access-Control-Allow-Headers。

从 cUrl 测试 cors 的唯一方法是使用 Origin 标头：curl cors