訪問控制允許來源不是由接入控制允許集管

Question

我有兩個單獨的服務器允許的，一個是nginx的與節點，另一個是django的與Django的休息 - 用於構建丁REST API框架，nginx的負責REST API請求，節點將客戶機請求的護理，也我使用polymer爲前端。下面是簡要說明：

機之一：

nginx:192.168.239.149:8888 (API listening address) forward to 192.168.239.147:8080 

node:192.168.239.149:80 (client listening address) 

機2：

unicorn:192.168.239.147:8080(listening address) 

的方法是，當一個請求到達，節點服務器（192.168.239.149:80）響應返回的HTML，以html AJAX請求請求一個PI服務器（ nginx:192.168.239.149:8888 forward to unicorn:192.168.239.147:8080），然後獨角獸（192.168.239.147:8080）返回結果。

但是有一個CORS問題，我看了很多文章，很多人遇到了同樣的問題，我嘗試了很多方法，但沒有help.still錯誤。

什麼，我得到的是：

那就是：

XMLHttpRequest cannot load http://192.168.239.149:8888/article/. Request header field Access-Control-Allow-Origin is not allowed by Access-Control-Allow-Headers. 

我做的是：

core-ajax

<core-ajax auto headers='{"Access-Control-Allow-Origin":"*","X-Requested-With": "XMLHttpRequest"}' url="http://192.168.239.149:8888/article/" handleAs="json" response="{{response}}"></core-ajax> 

nginx的：

http { 
    include  mime.types; 
    default_type application/octet-stream; 
    access_log /tmp/nginx.access.log; 
    sendfile on; 
    upstream realservers{ 
       #server 192.168.239.140:8080; 
       #server 192.168.239.138:8000; 
       server 192.168.239.147:8080; 
    } 
server { 
     listen  8888 default; 
     server_name example.com; 
     client_max_body_size 4G; 
     keepalive_timeout 5; 
     location/{ 
      add_header Access-Control-Allow-Origin *; 
       try_files $uri $uri/index.html $uri.html @proxy_to_app; 
       } 
location @proxy_to_app{ 
       add_header Access-Control-Allow-Origin *; 
       proxy_set_header X-Real-IP $remote_addr; 
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
       proxy_set_header Host $http_host; 
       #proxy_set_header X-Real-IP $remote_addr; 
       proxy_redirect off; 
       proxy_pass http://realservers; 
     } 
} 
} 

節點：

app.listen(80, function() { 
    console.log('server.js running'); 
}); 

麒麟：

return Response(serializer.data,headers={'Access-Control-Allow-Origin':'*', 
                      'Access-Control-Allow-Methods':'GET', 
                      'Access-Control-Allow-Headers':'Access-Control-Allow-Origin, x-requested-with, content-type', 
                      }) 

因爲我在CORS上沒有太多的經驗，我想徹底瞭解它，任何人都可以指出我在這裏做錯了什麼，我會非常感謝你！

Answer 1

哇，太激動了，我sovled這一切由我自己，我做什麼錯在這裏是請求頭我送不包括在nginx的配置add_header 'Access-Control-Allow-Headers'

完整nginx的配置：

http { 
    include  mime.types; 
    default_type application/octet-stream; 
    access_log /tmp/nginx.access.log; 
    sendfile on; 
    upstream realservers{ 
       #server 192.168.239.140:8080; 
       #server 192.168.239.138:8000; 
       server 192.168.239.147:8080; 
    } 
server { 
     listen  8888 default; 
     server_name example.com; 
     client_max_body_size 4G; 
     keepalive_timeout 5; 
     location/{ 
      add_header Access-Control-Allow-Origin *; 
      add_header 'Access-Control-Allow-Credentials' 'true'; 
      add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS'; 
      add_header 'Access-Control-Allow-Headers' 'Access-Control-Allow-Orgin,XMLHttpRequest,Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With'; 

       try_files $uri $uri/index.html $uri.html @proxy_to_app; 
       } 
location @proxy_to_app{ 
       add_header Access-Control-Allow-Origin *; 
       add_header 'Access-Control-Allow-Credentials' 'true'; 
       add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS'; 
       add_header 'Access-Control-Allow-Headers' 'Access-Control-Allow-Orgin,XMLHttpRequest,Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With'; 

       proxy_set_header X-Real-IP $remote_addr; 
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
       proxy_set_header Host $http_host; 
       #proxy_set_header X-Real-IP $remote_addr; 
       proxy_redirect off; 
       proxy_pass http://realservers; 
     } 
} 
} 

因爲我的要求是：

core-ajax auto headers='{"Access-Control-Allow-Origin":"*","X-Requested-With": "XMLHttpRequest"}' url="http://192.168.239.149:8888/article/" handleAs="json" response="{{response}}"></core-ajax> 

我沒有包括Access-Control-Allow-Origin和XMLHttpRequest頭進入nginx的配置Access-Control-Allow-Headers，所以這是問題。

我希望它對誰有同樣的問題有用！

Answer 2

您不必將CORS頭部包含在請求手冊中。瀏覽器照顧它，你只需要允許它在api服務器上