CORS Origin设置错误？

Question

1. 我有一个JavaScript应用程序让我们说它部署在上面portal.example.com.
2. 这包括一个<script>加载来自的服务器的标签assets.example.com.
3. 该JavaScript文件向API发出HTTP请求 admin.example.com

由于CORS飞行前失败,此API请求出错.

Failed to load http://admin.example.com/v0/user/navigation: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://portal.example.com' is therefore not allowed access.

实际OPTIONS要求如下

OPTIONS /v0/user/navigation HTTP/1.1
Host: admin.example.com
Connection: keep-alive
Access-Control-Request-Method: GET
Origin: http://portal.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Access-Control-Request-Headers: authorization,x-correlation-id,x-user-domain
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,en-GB;q=0.8

实际OPTIONS回复如下

HTTP/1.1 200
Allow: GET
Access-Control-Allow-Headers: authorization,x-correlation-id,x-user-domain
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: http://portal.example.com
Vary: Origin
Content-Length: 0
Date: Tue, 20 Feb 2018 12:12:19 GMT
Set-Cookie: 97d2c19dadc3933a73dce9bec0748df1=5a15895c5e0f5b526c177132cb4aa666; path=/; HttpOnly
Cache-control: private
X-RBT-SCAR: 10.127.48.7:777511903:1000

我认为问题是因为请求实际上是来自提供请求的脚本assets.example.com.所以,我应该返回Access-Control-Allow-Origin: http://assets.example.com的OPTIONS响应.但是,我遵循了W3C的建议.

Access-Control-Allow-Origin标头指示是否可以通过在响应中返回Origin请求标头的值"*"或"null"来共享资源.

我是误解CORS,还是浏览器发送Origin主执行URL而不是发出请求的脚本的URL？

更新

获得回应

HTTP/1.1 200
X-Correlation-Id: 8978b245-081a-4c4a-b4c9-73f2920ab55c
Content-Type: application/vnd.example+json
Transfer-Encoding: chunked
Date: Tue, 20 Feb 2018 13:22:39 GMT
Set-Cookie: 97d2c19dadc3933a73dce9bec0748df1=dc4e3543c3071d752959e7176c5e4d29; path=/; HttpOnly
Cache-control: private
X-RBT-SCAR: 10.127.48.7:778160108:2000

Answer 1

No 'Access-Control-Allow-Origin' header is present on the requested resource. 这意味着缺少"Access-Control-Allow-Origin"标头,而不是您的域名不被允许.

如果您没有获得许可,您会看到类似的内容

The 'Access-Control-Allow-Origin' header has a value 'http://www.example.com' that is not equal to the supplied origin.

因此,要解决您的问题,您需要配置GET响应以提供必要的CORS标头以及OPTIONS响应.

在您编辑的问题中,GET响应标题不提供任何内容, Access-Control-*这就是您收到错误的原因!