IIS 7.5的CORS设置

Question

有人可以帮助我,转换下面的代码在IIS 7.5中的web.config中使用,在web.config文件中我应该放置每段代码吗？

# Always set these headers.
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
Header always set Access-Control-Max-Age "1000"
Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"

# Added a rewrite to respond with a 200 SUCCESS on every OPTIONS request.
RewriteEngine On
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule ^(.*)$ $1 [R=200,L]

Answer 1

如果您要求解决CORS问题,可以按照以下解决方案进行操作.

注意:在添加所有这些之前,您应该考虑安全问题.

1. 将其添加到您的web.config文件中:

   <system.webServer>
     <httpProtocol>
       <customHeaders>
         <add name="Access-Control-Allow-Origin" value="*" />
         <add name="Access-Control-Allow-Methods" value="GET, PUT, POST, DELETE, HEAD, OPTIONS" />
         <add name="Access-Control-Allow-Credentials" value="true"/>
         <add name="Access-Control-Allow-Headers" value="X-Requested-With, origin, content-type, accept" />
       </customHeaders>
     </httpProtocol>
   </system.webServer>
   

2. 如果您在ajax调用中有Content-type参数,或者您正在执行PUT请求.这些请求被视为PreFlight请求.Preflight请求在发送主请求(PUT,DELETE等)之前正在执行 OPTION请求.您可以将以下方法添加到您的全局.asax文件成功传递OPTION进程:

   protected void Application_BeginRequest()
   {
       if (Request.Headers.AllKeys.Contains("Origin") && Request.HttpMethod == "OPTIONS")
       {
           Response.Flush();
       }
   }
   

要获得有关预检请求的更多信息,您可以在此处查看

对于2号解决方案,您可以从此处获得详细信息