相关疑难解决方法(0)

有没有办法允许多个跨域使用Access-Control-Allow-Origin标头？

我知道了*,但它太开放了.我真的想只允许一些域名.

举个例子,像这样:

Access-Control-Allow-Origin: http://domain1.example, http://domain2.example

我已经尝试过上面的代码,但它似乎不适用于Firefox.

是否可以指定多个域,或者我只坚持一个？

我有一个涉及的设置

前端服务器(Node.js,domain:localhost:3000)<--->后端(Django,Ajax,域:localhost:8000)

浏览器< - webapp < - Node.js(服务应用)

浏览器(webapp) - > Ajax - > Django(服务ajax POST请求)

现在,我的问题在于CORS设置,webapp使用它来向后端服务器进行Ajax调用.在chrome中,我一直在努力

当credentials标志为true时,无法在Access-Control-Allow-Origin中使用通配符.

在Firefox上也不起作用.

我的Node.js设置是:

var allowCrossDomain = function(req, res, next) {
    res.header('Access-Control-Allow-Origin', 'http://localhost:8000/');
    res.header('Access-Control-Allow-Credentials', true);
    res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    next();
};

而在Django我使用这个中间件 与此相伴

webapp发出如下请求:

$.ajax({
    type: "POST",
    url: 'http://localhost:8000/blah',
    data: {},
    xhrFields: {
        withCredentials: true
    },
    crossDomain: true,
    dataType: 'json',
    success: successHandler
});

因此,webapp发送的请求标头如下所示:

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: "Origin, X-Requested-With, Content-Type, Accept"
Access-Control-Allow-Methods: 'GET,PUT,POST,DELETE'
Content-Type: application/json 
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: …

AJAX请求工作正常,但是当我通过beforeSend或headers添加标头时,会发出OPTIONS运行前请求并中止GET请求.

  Code: $.ajax({
        type: "GET",
        crossDomain: true,
         beforeSend: function (xhr)
         {
         xhr.setRequestHeader("session", $auth);
         },
        url: $url,
        success: function (data) {
            $('#something').html(data);
        },
        error: function (request, error) {
            $('#something').html("<p>Error getting values</p>");
        }
    });

类似的 AJAX请求没有指定标题(当我添加/修改标题时,会进行OPTIONS调用)

Request GET /api/something?filter=1 HTTP/1.1
Referer http://app.xyz.dj/dashboard
Accept  application/json, text/javascript, */*; q=0.01
Accept-Language en-US
Origin  http://app.xyz.dj
Accept-Encoding gzip, deflate
User-Agent  Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MASMJS; rv:11.0) like Gecko
Host    162.243.13.172:8080
DNT 1
Connection  Keep-Alive
Cache-Control   no-cache

类似服务器响应标头(用于GET请求)

Response    HTTP/1.1 200 OK
Server  Apache-Coyote/1.1
Access-Control-Allow-Origin * …