使用koa-cors和Access-Control-Allow-Credentials进行故障排除

Question

我有这个错误

XMLHttpRequest无法加载http://127.0.0.1:1337/.对预检请求的响应未通过访问控制检查:当请求的凭据模式为"包含"时,响应中"访问控制 - 允许 - 凭证"标头的值为"必须为'真'.原产地" 的http://本地主机:63342 ",因此没有允许访问.XMLHttpRequest发起的请求的凭据模式由withCredentials属性控制.

我在这里读到了一些主题,但我没有找到适合我的解决方案.也许我只是不明白这一切是如何运作的.但是,我怎么能解决这个问题呢？先感谢您.

• server.js

const Koa = require('koa')
const Router = require('koa-router')
const koaBody = require('koa-body')()
const router = new Router({})
const koaCors = require('koa-cors')


router
	.post('/', koaBody, async function (ctx) {
		console.log(ctx.request.body)
		ctx.status = 200
		ctx.body = 'POST'
})
	.get('/', async function (ctx) {
		ctx.status = 200
		ctx.body = 'GET'
	})

exports.createServer = function () {
	const app = new Koa()
	app
		.use(router.routes())
		.use(router.allowedMethods())
		.use(koaCors())
	app.listen(1337)
}

exports.createServer()

• index.js

function submitForm(form) {
	let xhr = new XMLHttpRequest()
	xhr.withCredentials = true;
	xhr.open('POST', 'http://127.0.0.1:1337/', true)
	xhr.setRequestHeader('Access-Control-Allow-Origin', '*')
	let formData = new FormData(form)
	let body = {
		name: formData.get('name'),
		password: formData.get('password'),
		message: formData.get('message')
	}
	xhr.onreadystatechange = function() {
		if(xhr.status == 200) {
			alert('Hello!')
		} else {
			alert('Something went wrong')
		}
	}
	xhr.send(JSON.stringify(body))
}

$(document).ready(function () {
	$('#form').submit(function (event) {
		event.preventDefault();
		if (validateForm($form)) {
			$('#modal-form').modal('hide');
			submitForm($form)
		}
		return false;
	})
});

更新:

我希望我修复服务器端.我的index.js现在:

function submitForm(form) {
let xhr = new XMLHttpRequest()
xhr.withCredentials = true;
xhr.open('POST', 'http://127.0.0.1:1337/', true)
xhr.setRequestHeader('Access-Control-Allow-Origin', '*')
let formData = new FormData(form)
xhr.onreadystatechange = function() {
    if(xhr.status == 200) {
        alert('Hello!')
        console.log(xhr.response);
    } else {
        alert('Something went wrong')
    }
}
xhr.send(formData)

}

和server.js:

router
.post('/', koaBody, function (ctx) {
    console.log(ctx.request.body)
    ctx.status = 200
    ctx.body = 'POST'
})
.get('/', function (ctx) {
    ctx.status = 200
    ctx.body = 'GET'
});exports.createServer = function () {
const app = new Koa()
const koaOptions = {
    origin: true,
    credentials: true
};
app
    .use(router.routes())
    .use(router.allowedMethods())
    .use(cors(koaOptions))
app.listen(1337)}

然后再次 No 'Access-Control-Allow-Origin' header is present on the requested resource.

现在我做错了什么？

Answer 1

响应中“Access-Control-Allow-Credentials”标头的值为“”，当请求的凭据模式为“包含”时，该值必须为“真”。

为了防止这个问题，你需要设置 koa-corscredentials选项：

exports.createServer = function () {
    const app = new Koa()
    const koaOptions = {
      origin: true,
      credentials: true
    };
    app
        .use(router.routes())
        .use(router.allowedMethods())
        .use(koaCors(koaOptions))
    app.listen(1337)
}

Answer 2

如果请求的“withCredentials”为 true，则即使没有 Access-Control-Allow-Credentials 标头，也无法使用 Access-Control-Allow-Origin: * 。