处理Apache中的CORS预检请求

Question

我使用Yeoman部署了一个AngularJS应用程序.Cakephp RESTful后端.

Angular应用程序发送OPTIONS预检请求,后端响应禁止(403),在nginx中解决了我使用过的这个问题:

if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' '*'; 
     add_header 'Access-Control-Allow-Credentials' 'true';
     add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE'; 
     add_header 'Access-Control-Allow-Headers' 'X-AuthTokenHeader,Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since';   
     add_header 'Access-Control-Max-Age' 1728000;
     add_header 'Content-Type' 'text/plain charset=UTF-8';
     add_header 'Content-Length' 0;
     return 204; 
}

我如何在Apache中执行此操作？请提供一些初步指导/意见,我会在此之后弄清楚细节并用细化的细节改进问题.

Answer 1

我有同样的问题,给出的答案并没有解决问题.

通过查看更多我发现你可以使用重写来做到这一点,例如:

RewriteEngine On                  
RewriteCond %{REQUEST_METHOD} OPTIONS 
RewriteRule ^(.*)$ $1 [R=200,L]    

(确保启用重写mod)

然后你应该使用"always set"来设置标题,例如:

Header always set Access-Control-Allow-Origin "*"                   
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS"

解释如下:https://serverfault.com/questions/231766/returning-200-ok-in-apache-on-http-options-requests

Answer 2

将此.htaccess文件添加到您的apache根目录:

Header add Access-Control-Allow-Origin "*"
Header add Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header add Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

确保激活apache模块头:

a2enmod headers

资料来源:https://stackoverflow.com/a/11691776/1494875