相关疑难解决方法(0)

我有一个涉及的设置

前端服务器(Node.js,domain:localhost:3000)<--->后端(Django,Ajax,域:localhost:8000)

浏览器< - webapp < - Node.js(服务应用)

浏览器(webapp) - > Ajax - > Django(服务ajax POST请求)

现在,我的问题在于CORS设置,webapp使用它来向后端服务器进行Ajax调用.在chrome中,我一直在努力

当credentials标志为true时,无法在Access-Control-Allow-Origin中使用通配符.

在Firefox上也不起作用.

我的Node.js设置是:

var allowCrossDomain = function(req, res, next) {
    res.header('Access-Control-Allow-Origin', 'http://localhost:8000/');
    res.header('Access-Control-Allow-Credentials', true);
    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    next();
};

而在Django我使用这个中间件 与此相伴

webapp发出如下请求:

$.ajax({
    type: "POST",
    url: 'http://localhost:8000/blah',
    data: {},
    xhrFields: {
        withCredentials: true
    },
    crossDomain: true,
    dataType: 'json',
    success: successHandler
});

因此,webapp发送的请求标头如下所示:

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: "Origin, X-Requested-With, Content-Type, Accept"
Access-Control-Allow-Methods: 'GET,PUT,POST,DELETE'
Content-Type: application/json 
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: …

我试图了解如何使用CORS,并对Access-Control-Allow-Credentials标题的作用感到困惑.

文件说

指示凭证标志为true时是否可以公开对请求的响应.

但我不明白"暴露"的反应意味着什么.

任何人都可以解释这个标题被设置为true(与设置为true的凭证标志一起)实际上是什么？

我有一个简单的PHP脚本,我正在尝试跨域CORS请求:

<?php
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Headers: *");
...

但我仍然得到错误:

X-Requested-With不允许请求标头字段Access-Control-Allow-Headers

我缺少什么？

我无法使用chrome获得跨域cors请求以正常工作.

请求标题:

Accept:*/*
Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Access-Control-Request-Headers:origin, content-type
Access-Control-Request-Method:POST
Connection:keep-alive
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1229.94 Safari/537.4

响应标头:

Access-Control-Allow-Headers:*
Access-Control-Allow-Origin:*
Allow:GET, POST, OPTIONS
Content-Length:0
Date:Tue, 30 Oct 2012 20:04:28 GMT
Server:BaseHTTP/0.3 Python/2.7.3

错误:

XMLHttpRequest cannot load domain. Request header field Content-Type is not allowed by Access-Control-Allow-Headers.

并且为选项请求提供的python代码是:

self.send_response(200)
self.send_header('Allow', 'GET, POST, OPTIONS')
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Headers', '*')
self.send_header('Content-Length', '0')
self.end_headers()

似乎忽略了Access-Control-Allow-Origin通配符？

我正在尝试从domain.com向a.domain.com发出CORS请求POST.

我的javascript看起来像这样

$('#fileupload').fileupload({
  xhrFields: {
    withCredentials: true
  },
  dataType: 'json',
  url: $('#fileupload').data('path'),
  singleFileUploads: true,
  add: function(e, data){
    data.submit();
  }
});

首先,我看到OPTIONS路由被调用如下:

Request URL: https://a.domain.com/some/route
Request Method:OPTIONS
Status Code:200 OK

选项要求:

Access-Control-Request-Headers:origin, content-type, accept
Access-Control-Request-Method:POST
Host:a.domain.com
Origin:http://domain.com:3000
Referer:http://domain.com:3000/home

选项响应

Access-Control-Allow-Credentials:true
Access-Control-Allow-Methods:POST
Access-Control-Allow-Origin:http://domain.com:3000
Connection:keep-alive
Content-Length:0
Content-Type:text/html;charset=utf-8

这个要求回来了200个说明.在我的服务器上,我有相同的路由POST方法,这是我得到的回报之后OPTIONS

Request URL:https://a.domain.com/some/route

发出请求

Content-Type:multipart/form-data; boundary=----WebKitFormBoundaryjwr5Pk7WBcfzMdbO
Origin:http://domain.com:3000
Referer:http://domain.com:3000/home

并且POST请求被取消/失败.

我的问题是,我是否还需要在POST控制器上拥有access-control-allow-origin？

我有一个用于授权的cookie,该cookie具有cookie,.domain.com该cookie在请求中被发送过一次并且现在没有被发送.知道为什么会这样吗？

突然间,似乎没有改变我的网络应用程序中的任何内容,我在Chrome中打开它时开始出现CORS错误.我尝试添加Access-Control-Allow-Origin: *标题.然后我收到这个错误:

XMLHttpRequest cannot load http://localhost:9091/sockjs-node/info?t= 1449187563637. A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin 'http://localhost:3010' is therefore not allowed access.

但正如您在下图中看到的那样,没有Access-Control-Allow-Credentials标题.

WTF？Chrome bug？

我的页面被加载,http://localhost:3010该服务器也使用Access-Control-Allow-Origin: *没有问题.如果两个端点都使用它会有问题吗？

我一直在寻找解决这个问题的方法.

我有一个带有Laravel 4后端实现的AngularJS Web应用程序,如下所示:

http://app.mydomain.io/ = AngularJS web app
http://api.mydomain.io/ = Laravel Back-end

在Laravel的routes.php文件中,我有以下PHP代码来设置Access-Control标头:

header('Access-Control-Allow-Origin: http://app.mydomain.io');
header('Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE');

我还有一个登录请求的路由设置,如下所示:

Route::post('/login', function()
{
    $email = Input::get('email');
    $password = Input::get('password');
    if (Auth::attempt(array('email' => $email, 'password' => $password)))
    {
        return "Success!";
    } else {
        return "Fail!";
    }
});

在AngularJS中,我有一个AuthService,如下所示:

app.factory('AuthService', ['$resource', '$q', '$cookieStore', function($resource, $q, $cookieStore) {
    var user = null;
    var Service = $resource('//api.mydomain.io/login/', {}, {});
    return {
        login: function(email, password) {
            var deferred = $q.defer();
            Service.save({email: email, …