Access-Control-Allow-Origin标头不起作用 - 我做错了什么？

Question

我试图提供HTTP OPTIONS方法的响应与Access-Control-Allow-Origin标头复制请求中的Origin标头的内容.

由于我无法弄清楚的原因,这显然不起作用.

tl; dr: 来自OPTIONS的回应说:

Access-Control-Allow-Origin: http://10.0.0.105:9294

随后的GET有:

Origin:http://10.0.0.105:9294

Chrome说:

Origin http://10.0.0.105:9294 is not allowed by Access-Control-Allow-Origin

WTF不是吗？

更多详情...

通过查看Chrome的开发者工具窗口,请求标头是:

OPTIONS /user/kris HTTP/1.1
Host: 10.0.0.104:8080
Connection: keep-alive
Access-Control-Request-Method: GET
Origin: http://10.0.0.105:9294
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.75 Safari/537.1
Access-Control-Request-Headers: origin, x-requested-with, content-type, accept
Accept: */*
Referer: http://10.0.0.105:9294/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-GB,en-US;q=0.8,en;q=0.6
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

响应标头是:

HTTP/1.0 200 OK
Date: Mon, 13 Aug 2012 11:23:45 GMT
Server: WSGIServer/0.1 Python/2.7.3
Content-Length: 0
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, HEAD, OPTIONS
Access-Control-Max-Age: 10
Access-Control-Allow-Origin: http://10.0.0.105:9294
Access-Control-Allow-Headers: X-Requested-With, Authorization, X-Huzu-User, Content-Type, Accept
Content-Type: text/html; charset=UTF-8

在jQuery发送其OPTIONS请求并获得上述响应之后,发生了两件奇怪的事情.OPTIONS响应(200)在开发者控制台中显示为错误:

OPTIONS http://10.0.0.104:8080/user/kris 200 (OK)

之后,拒绝GET请求.控制台出错:

XMLHttpRequest cannot load http://10.0.0.104:8080/user/kris. Origin http://10.0.0.105:9294 is not allowed by Access-Control-Allow-Origin.

我不明白为什么不.我究竟做错了什么？

Answer 1

好的,我想我已经知道了.似乎必须正确处理飞行前的OPTIONS请求,但对于跨站点资源请求的工作并不充分.

在OPTIONS请求返回满意的标题后,对同一URL的任何后续请求的所有响应也必须具有必要的"Access-Control-Allow-Origin"标题,否则浏览器将吞下它们,它们甚至不会显示在调试器窗口中.

因此,它会像浏览器取消,因为在OPTIONS响应一些问题的要求,但实际上,浏览器正在考虑从实际请求的响应报头,然后拒绝他们.