为什么localhost需要CORS？

Question

我可能已经在stackoverflow上找到了一个答案,我提前抱歉,我找不到它.

我在我的localhost上运行了一个小型TCP服务器,出于安全原因,它不支持CORS.

我的问题是,如果CORS用于跨域保护,为什么在http://localhost/请求连接页面时请求它http://localhost:xxxx

我知道我可以在浏览器中关闭安全性,但我试图理解为什么localhost到localhost连接被视为跨源连接.

XMLHttpRequest cannot load http://localhost:8000/. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:63342' is therefore not allowed access. The response had HTTP status code 500.

Answer 1

因为localhost(端口80)是一个不同的主机localhost:8000.

请参阅RFC 6454,第5节:

  If the two origins are scheme/host/port triples, the two origins
  are the same if, and only if, they have identical schemes, hosts,
  and ports.