具有302重定向和withCredentials = true的Chrome和CORS

Ken*_* D. 5 google-chrome xmlhttprequest cors http-status-code-302

使用基于Chromium的浏览器和包含302重定向的CORS请求时遇到问题。更具体地说,我在Chromium版本34-42(含)之间遇到麻烦;43和更高版本有效,并且似乎33和更早版本也适用(我在33到28之前还没有测试太多)。

我的XHR请求使用withCredentials = true,因此不允许Access-Control-Allow-Origin =“ *”;服务器必须使用Access-Control-Allow-Origin标头进行回复,该标头与传入请求的Origin标头相呼应。

在收到第一个302之后,Chromium 43和更高版本发送“ Origin:null”作为重定向请求的一部分,并接受“ Access-Control-Allow-Origin:null”作为响应(Firefox也是如此)。

Chromium系列34-42都将所有请求的主机名发送为Origin,此后的几个问题表明, 在Access-Control-Allow-Origin设置为“ *” 时才支持CORS重定向,并且“原始” XHR不得将allow-credentials设置为true”,例如:

我希望这是一个误解,作为应用程序开发人员,我可以在客户端和/或服务器上执行某些操作,以强制那些版本不取消重定向,否则,将无法解决此问题。

版本33及更早版本为每个请求发送了完整的主机名,并且完整的往返操作有效。

对于一种可能解决办法我已经从事实,我其实也源于实验并不需要withCredentials =真正的跨域请求,我只需要它重定向回原始主机交换基于cookie的身份验证一个access_token,但是除非遵循原始302跨域请求发送,否则我无法找到一种方法来使客户端在向其自身发送302时发送cookie。

为了说明这一点,以下是chrome:// net-internals /#events日志中摘录的有关使用Chrome 43的成功请求的摘录:

    [img src]
    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
    --> GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg?timestamp=1437075435614 HTTP/1.1
        Host: media-qa.example.com
        Origin: https://qa-app.example.com
        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
        Referer: https://qa-app.example.com/media/photos/
        Cookie: [1568 bytes were stripped]
    HTTP_TRANSACTION_READ_RESPONSE_HEADERS
    --> HTTP/1.1 302 FOUND
        Access-Control-Allow-Credentials: true
        Access-Control-Allow-Headers: X-HTTP-Method-Override, Content-Type, X-Requested-With
        Access-Control-Allow-Origin: https://qa-app.example.com
        Content-Type: text/html; charset=utf-8
        Location: https://qa-app.example.com/oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437075435614

    [get cross-domain access token]
    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
    --> GET /oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437075435614 HTTP/1.1
        Host: qa-app.example.com
        Origin: null
        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
        Referer: https://qa-app.example.com/media/photos/
        Cookie: [1762 bytes were stripped]
    HTTP_TRANSACTION_READ_RESPONSE_HEADERS
    --> HTTP/1.1 302 FOUND
        Access-Control-Allow-Credentials: true
        Access-Control-Allow-Headers: Content-Type, X-HTTP-Method-Override, X-Requested-With
        Access-Control-Allow-Origin: null
        Content-Type: text/html; charset=utf-8
        Location: https://media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?timestamp=1437075435614&access_token=L221i4rC5R8NY2AbP4lIxo7apr6HlIHttKroKkQi3tzUSaL7NE7aoBcLUI432Mast8b/NH7ksFfRhsCOhK7P86Lc4C9GlkRn%2Bze/UBJeG8gbRVlnxdjdzBFfp9kAbYR9onDM9b1bUdRaV1q19it8OL3aBzThrmng1E%2BMmT%2BVyK0qXLqQ6yA/tHfrgyC9XwFbKqW6BQSpLOyVOPHZZ4t3dgzimTD9HJCbLUUjZt7nf7iCAOBcaR9CiUH8vlcP4wkOmXk3AoDslYu6IUZtRHrSs7OplBtTXgmzBlSaum%2BccFzdNu5TuH%2BQkmp2QQHErwRJkUNN9S5ZcRzlXdUGg8%2B698Wh5zYFVa%2B/pEfykkf%2BAuqKjbVicGq%2BgxCYOCuqe4YJU/GPMHsBC6gvVYFmtkDaG4za1N4fvbmBb9u%2BHHZNdW0kvj55N9QgJ86lHZjddvfEivET0TVTo1u0u6Wp/TM4EMXLtMK3urBpEAMWBT9PlE8%3D

    [url redirection service adds cloudfront signature]
    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
    --> GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?timestamp=1437075435614&access_token=L221i4rC5R8NY2AbP4lIxo7apr6HlIHttKroKkQi3tzUSaL7NE7aoBcLUI432Mast8b/NH7ksFfRhsCOhK7P86Lc4C9GlkRn%2Bze/UBJeG8gbRVlnxdjdzBFfp9kAbYR9onDM9b1bUdRaV1q19it8OL3aBzThrmng1E%2BMmT%2BVyK0qXLqQ6yA/tHfrgyC9XwFbKqW6BQSpLOyVOPHZZ4t3dgzimTD9HJCbLUUjZt7nf7iCAOBcaR9CiUH8vlcP4wkOmXk3AoDslYu6IUZtRHrSs7OplBtTXgmzBlSaum%2BccFzdNu5TuH%2BQkmp2QQHErwRJkUNN9S5ZcRzlXdUGg8%2B698Wh5zYFVa%2B/pEfykkf%2BAuqKjbVicGq%2BgxCYOCuqe4YJU/GPMHsBC6gvVYFmtkDaG4za1N4fvbmBb9u%2BHHZNdW0kvj55N9QgJ86lHZjddvfEivET0TVTo1u0u6Wp/TM4EMXLtMK3urBpEAMWBT9PlE8%3D HTTP/1.1
        Host: media-qa.example.com
        Origin: null
        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
        Referer: https://qa-app.example.com/media/photos/
        Cookie: [1568 bytes were stripped]
    HTTP_TRANSACTION_READ_RESPONSE_HEADERS
    --> HTTP/1.1 302 FOUND
        Access-Control-Allow-Credentials: true
        Access-Control-Allow-Headers: X-HTTP-Method-Override, Content-Type, X-Requested-With
        Access-Control-Allow-Origin: null
        Content-Type: text/html; charset=utf-8
        Location: https://gbbrsh.cloudfront.net/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?Expires=1437075499&Signature=RpCVix5lcF5~Arah0WxhSoB3SN7ZfxXIwnaL8EOdlslIz5c9Ycic1wF~sjwTnWD5fxS~SBhexIz37oqjHjED3MTPiXAmuPjO1mQ-V8ACc8N-geWBIvMQRw9kCjCRmtquSs7TynaFqopv0BpQKH2G1xVdfoDaOZZWso7pXnpR50c2NdyDD-WMZNLKJ657Dj4-wCL8ZJdUPOgiXsfcxM1AZGy5P034SCL8JB8ZyEh1bUDszLkQa8lIpsy08mt9t8ZjFcR2i6bqBZNZOquT3jbOEy8VprL4lmtyOmVJaNTaBevZC6rQ6CM~jd~Ya2FockK5bNGYxM043OU71NExS0lHTg__&Key-Pair-Id=APKAJNUAAHKHVOSPPXTQ
        Set-Cookie: [349 bytes were stripped]

    [finally, get cloudfront image]
    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
    --> GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?Expires=1437075499&Signature=RpCVix5lcF5~Arah0WxhSoB3SN7ZfxXIwnaL8EOdlslIz5c9Ycic1wF~sjwTnWD5fxS~SBhexIz37oqjHjED3MTPiXAmuPjO1mQ-V8ACc8N-geWBIvMQRw9kCjCRmtquSs7TynaFqopv0BpQKH2G1xVdfoDaOZZWso7pXnpR50c2NdyDD-WMZNLKJ657Dj4-wCL8ZJdUPOgiXsfcxM1AZGy5P034SCL8JB8ZyEh1bUDszLkQa8lIpsy08mt9t8ZjFcR2i6bqBZNZOquT3jbOEy8VprL4lmtyOmVJaNTaBevZC6rQ6CM~jd~Ya2FockK5bNGYxM043OU71NExS0lHTg__&Key-Pair-Id=APKAJNUAAHKHVOSPPXTQ HTTP/1.1
        Host: gbbrsh.cloudfront.net
        Origin: null
        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
        Referer: https://qa-app.example.com/media/photos/
    HTTP_TRANSACTION_READ_RESPONSE_HEADERS
    --> HTTP/1.1 200 OK
        Content-Length: 48776
        Access-Control-Allow-Origin: null
        Access-Control-Allow-Methods: GET
        Access-Control-Max-Age: 3000
        Access-Control-Allow-Credentials: true
        Vary: Origin
Run Code Online (Sandbox Code Playgroud)

这里是使用版本42的失败日志,请注意,上面使用43进行的所有重定向都发送了“ Origin:null”,但是42发送了主机名(服务器答复),客户端取消了该请求:

    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
    --> GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg?timestamp=1437074740624 HTTP/1.1
        Host: media-qa.example.com
        Origin: https://qa-app.example.com
        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36
        Referer: https://qa-app.example.com/media/photos/
        Cookie: [1571 bytes were stripped]
    HTTP_TRANSACTION_READ_RESPONSE_HEADERS
    --> HTTP/1.1 302 FOUND
        Access-Control-Allow-Credentials: true
        Access-Control-Allow-Headers: X-HTTP-Method-Override, Content-Type, X-Requested-With
        Access-Control-Allow-Origin: https://qa-app.example.com
        Location: https://qa-app.example.com/oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437074740624

    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
    --> GET /oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437074740624 HTTP/1.1
        Host: qa-app.example.com
        Origin: https://qa-app.example.com
        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36
        Referer: https://qa-app.example.com/media/photos/
        Cookie: [1769 bytes were stripped]
    HTTP_TRANSACTION_READ_RESPONSE_HEADERS
    --> HTTP/1.1 302 FOUND
        Access-Control-Allow-Credentials: true
        Access-Control-Allow-Headers: Content-Type, X-HTTP-Method-Override, X-Requested-With
        Access-Control-Allow-Origin: https://qa-app.example.com
        Location: https://media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?timestamp=1437074740624&access_token=JbXemck/weq2TjoVtgwuXDZB1GgmBqlDix3z5WfsWFlf2aZVmCud99wtAU%2BBErVxm6Lk1MRP1ubM/bf59URPs9uXMLYC%2Bnk6lAYQRUBhO3UmBnZk967W/5f9/1YnfRHQe1Y9fGRSkddQJdzdOwkMAvYSCw%2BN1ofkrb4tYKz9OWja1WRuim82Mt5uzdb5eXVLUnlCCgqt9LjN6yDHPm7UjMwQMG8V0kFPIkL4ZGb/5WfXXa2NJY1Qq3GbFGFQID49vw/XDP6B9q9kRIL4D/NuLUocRUvw5iHZciqygpnJl1GaRcVr%2B5%2BBbKBw3c0Gou4X/ojiewnds2pYPPxNGKploy88l4GcjpGw%2BXmDiP4wUgCojhRporBjp2y87AnaY1k6BSI1j9xHxiSnjXT7pMsyXpBfMYCoAwV/w1Fh1E/Tu1ygXJhaOHAx%2B19BxOIYPWFJVw3djggbkN1jRo%2Bde%2BolGjfEXtFarwfx4nyCeNyYAd0%3D
        Vary: Accept-Encoding
  URL_REQUEST_DELEGATE  [dt=0]
 +URL_REQUEST_DELEGATE  [dt=3]
    DELEGATE_INFO  [dt=3]
    --> delegate_info = "AsyncResourceHandler"
 -URL_REQUEST_DELEGATE
  CANCELLED
Run Code Online (Sandbox Code Playgroud)

正如我提到的,如果您返回到版本33,即使客户端在所有请求的原始标头中发送主机名,它也可以工作:

    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
    --> GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg?timestamp=1437076851710 HTTP/1.1
        Host: media-qa.example.com
        Origin: https://qa-app.example.com
        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36
        Referer: https://qa-app.example.com/media/photos/
        Cookie: [1550 bytes were stripped]
    HTTP_TRANSACTION_READ_RESPONSE_HEADERS
    --> HTTP/1.1 302 FOUND
        Access-Control-Allow-Credentials: true
        Access-Control-Allow-Headers: X-HTTP-Method-Override, Content-Type, X-Requested-With
        Access-Control-Allow-Origin: https://qa-app.example.com
        Location: https://qa-app.example.com/oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437076851710

    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
    --> GET /oauth/authorize/?request_uri=https%3A//media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ%3D%3D.jpg%3Ftimestamp%3D1437076851710 HTTP/1.1
        Host: qa-app.example.com
        Origin: https://qa-app.example.com
        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36
        Referer: https://qa-app.example.com/media/photos/
        Cookie: [1763 bytes were stripped]
    HTTP_TRANSACTION_READ_RESPONSE_HEADERS
    --> HTTP/1.1 302 FOUND
        Access-Control-Allow-Credentials: true
        Access-Control-Allow-Headers: Content-Type, X-HTTP-Method-Override, X-Requested-With
        Access-Control-Allow-Origin: https://qa-app.example.com
        Location: https://media-qa.example.com/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?timestamp=1437076851710&access_token=C30mMVgoZSZtkpm3vgMNfLZEpkKT//%2BiZK5gbR39dvPfIaezfjNMocXJ0UCCH10jcE0yvOIrT8yISHerVvGZlGPy2rr2YwXkh1IsYcl0uNGYOP2bDYyz1cJNAwnRYZ4qS0uctDQiKNGZi3oC10TdIwzhz8aaOFAosRFEjPqrT553aXjpZr2SE4Z73TtU2pd%2B7ILICARbjp0r9yhDAAauJgQHkBAkcLVvW5TARQBeRR1OtXbf0CjN764EZ/2GEqCRhvo0rtVUQGUVpt/Sur9yFYUh1b/rFOZJ0o/Oj8rEUEg2c8p/O1ZrpN8emKMB%2BVWLXG97DPO6QpQmzGvaYCZsUDwGfvPNJ8wCtXEdQF0RzQMv3HG71StD9lK30BB46sDTuP24w7tH4PxqjY0cWBUpaMMz/mKLWuSWY6lerx7ibB7Gp%2B9OsclEHeaxKwFr%2BD63RFPmTwBtHKOF/PjIo%2BbmoxJZ07eJYAEYXDtfoLmFvM8%3D
        Vary: Accept-Encoding

    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
    --> GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?timestamp=1437076851710&access_token=C30mMVgoZSZtkpm3vgMNfLZEpkKT//%2BiZK5gbR39dvPfIaezfjNMocXJ0UCCH10jcE0yvOIrT8yISHerVvGZlGPy2rr2YwXkh1IsYcl0uNGYOP2bDYyz1cJNAwnRYZ4qS0uctDQiKNGZi3oC10TdIwzhz8aaOFAosRFEjPqrT553aXjpZr2SE4Z73TtU2pd%2B7ILICARbjp0r9yhDAAauJgQHkBAkcLVvW5TARQBeRR1OtXbf0CjN764EZ/2GEqCRhvo0rtVUQGUVpt/Sur9yFYUh1b/rFOZJ0o/Oj8rEUEg2c8p/O1ZrpN8emKMB%2BVWLXG97DPO6QpQmzGvaYCZsUDwGfvPNJ8wCtXEdQF0RzQMv3HG71StD9lK30BB46sDTuP24w7tH4PxqjY0cWBUpaMMz/mKLWuSWY6lerx7ibB7Gp%2B9OsclEHeaxKwFr%2BD63RFPmTwBtHKOF/PjIo%2BbmoxJZ07eJYAEYXDtfoLmFvM8%3D HTTP/1.1
        Host: media-qa.example.com
        Origin: https://qa-app.example.com
        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36
        Referer: https://qa-app.example.com/media/photos/
        Cookie: [1550 bytes were stripped]
    HTTP_TRANSACTION_READ_RESPONSE_HEADERS
    --> HTTP/1.1 302 FOUND
        Access-Control-Allow-Credentials: true
        Access-Control-Allow-Headers: X-HTTP-Method-Override, Content-Type, X-Requested-With
        Access-Control-Allow-Origin: https://qa-app.example.com
        Location: https://gbbrsh.cloudfront.net/media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?Expires=1437076916&Signature=WBDGSQXer-zAREYgiD1~DA8pUaNUBha4WrUFt-WI5Soh4Z-5ayw35UocOG7DuC9FOnAQAeU5Nvp8hKdofDB--ic4aMH0e~LmHaJ38GtP-lHnyyfQDpjJOEmGM2GY3sB0KG7qa8~eTXX9jKDJTCG9Hkf0EpievuWwiXEKGYaSbe0tkR4CLyhND3sIDJbFGCQQZ7NmhMB-3vOsqDKYKKz9SebuiqO0qbL8SvqBkMEiufXCF2MriR4hVDEjFQssE3ysBbhiMlkaINAeOkEmiZEAjnhB-ncN31Lvy4Lo1LxiyCqKH9QwPOpa6ukK0WrYXWwiTi2VRAaxSjm-xgbGiIArmA__&Key-Pair-Id=APKAJNUAAHKHVOSPPXTQ

    HTTP_TRANSACTION_SEND_REQUEST_HEADERS
    --> GET /media/uploads/bucket/a746a337-5c20-46a6-a1fc-701e772970fd-bWFpbi1uLW4tMC0wLTAtNDUwLTQ0NQ==.jpg?Expires=1437076916&Signature=WBDGSQXer-zAREYgiD1~DA8pUaNUBha4WrUFt-WI5Soh4Z-5ayw35UocOG7DuC9FOnAQAeU5Nvp8hKdofDB--ic4aMH0e~LmHaJ38GtP-lHnyyfQDpjJOEmGM2GY3sB0KG7qa8~eTXX9jKDJTCG9Hkf0EpievuWwiXEKGYaSbe0tkR4CLyhND3sIDJbFGCQQZ7NmhMB-3vOsqDKYKKz9SebuiqO0qbL8SvqBkMEiufXCF2MriR4hVDEjFQssE3ysBbhiMlkaINAeOkEmiZEAjnhB-ncN31Lvy4Lo1LxiyCqKH9QwPOpa6ukK0WrYXWwiTi2VRAaxSjm-xgbGiIArmA__&Key-Pair-Id=APKAJNUAAHKHVOSPPXTQ HTTP/1.1
        Host: gbbrsh.cloudfront.net
        Origin: https://qa-app.example.com
        User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.117 Safari/537.36
        Referer: https://qa-app.example.com/media/photos/
    HTTP_TRANSACTION_READ_RESPONSE_HEADERS
    --> HTTP/1.1 200 OK
        Access-Control-Allow-Origin: https://qa-app.example.com
        Access-Control-Allow-Methods: GET
        Access-Control-Max-Age: 3000
        Access-Control-Allow-Credentials: true
        Vary: Origin
Run Code Online (Sandbox Code Playgroud)