如何解決Rails中的訪問控制？

Question

我試圖採用了棱角分明的js POST請求發送POST請求我的軌道API，但我收到此錯誤：

XMLHttpRequest cannot load http://localhost:3000/api/v1/dis_generics. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:9000' is therefore not allowed access. The response had HTTP status code 404. 

我試圖找到一種方法如何使用的角度來發送POST請求到Rails api。我的在軌控制是這樣的：

  class DisGenericsController < ApplicationController 
      before_action :set_dis_generic, only: [:show, :edit, :update, :destroy] 
     skip_before_action :verify_authenticity_token 
      # GET /dis_generics 
      # GET /dis_generics.json 
      def index 
      # @dis_generics = DisGeneric.all 
      respond_to do |format| 
       format.html 
       format.json { render json: DisGenericDatatable.new(view_context) } 
      end 
      end 

      # GET /dis_generics/1 
      # GET /dis_generics/1.json 
      def show 
      end 

      # GET /dis_generics/new 
      def new 
      @dis_generic = DisGeneric.new 
      end 

      # GET /dis_generics/1/edit 
      def edit 
      end 

      # POST /dis_generics 
      # POST /dis_generics.json 
      def create 
      @dis_generic = DisGeneric.new(dis_generic_params) 

      respond_to do |format| 
       if @dis_generic.save 
       format.html { redirect_to @dis_generic, notice: 'Dis generic was successfully created.' } 
       format.json { render :show, status: :created, location: @dis_generic } 
       else 
       format.html { render :new } 
       format.json { render json: @dis_generic.errors, status: :unprocessable_entity } 
       end 
      end 
      end 

      # PATCH/PUT /dis_generics/1 
      # PATCH/PUT /dis_generics/1.json 
      def update 
      respond_to do |format| 
       if @dis_generic.update(dis_generic_params) 
       format.html { redirect_to @dis_generic, notice: 'Dis generic was successfully updated.' } 
       format.json { render :show, status: :ok, location: @dis_generic } 
       else 
       format.html { render :edit } 
       format.json { render json: @dis_generic.errors, status: :unprocessable_entity } 
       end 
      end 
      end 

      # DELETE /dis_generics/1 
      # DELETE /dis_generics/1.json 
      def destroy 
      @dis_generic.destroy 
      respond_to do |format| 
       format.html { redirect_to dis_generics_url, notice: 'Dis generic was successfully destroyed.' } 
       format.json { head :no_content } 
      end 
      end 

      private 
      # Use callbacks to share common setup or constraints between actions. 
      def set_dis_generic 
       @dis_generic = DisGeneric.find(params[:id]) 
      end 

      # Never trust parameters from the scary internet, only allow the white list through. 
      def dis_generic_params 
       params.require(:dis_generic).permit(:name, :is_combination, :rxcui, :status_id, :food_id, :hepatic_id, :renal_imp_id, :release_status_id, :is_essential) 
      end 
     end 

，這是我的角請求：

var req = { 
method: 'POST', 
url: 'http://localhost:3000/api/v1/dis_generics', 
headers: { 
    "Content-Type": "application/json" 
}, 
data: {} 
} 
$http(req).success(function(data, status, header, config) { 

警報（ 「失敗消息：」 + JSON.stringify（{數據：數據}））; }）;

這是我的應用程序控制器：

 class ApplicationController < ActionController::Base 
     # Prevent CSRF attacks by raising an exception. 
     # For APIs, you may want to use :null_session instead. 
     include StaticPagesHelper 
     skip_before_filter :verify_authenticity_token 
      before_filter :cors_preflight_check 
    after_filter :cors_set_access_control_headers 
     protect_from_forgery unless: -> { request.format.json? } 

     def cors_set_access_control_headers 
     headers['Access-Control-Allow-Origin'] = '*' 
     headers['Access-Control-Allow-Methods'] = 'POST, GET, OPTIONS' 
     headers['Access-Control-Allow-Headers'] = '*' 
     headers['Access-Control-Max-Age'] = "1728000" 
     end 

     # If this is a preflight OPTIONS request, then short-circuit the 
     # request, return only the necessary headers and return an empty 
     # text/plain. 

     def cors_preflight_check 
     if request.method == :options 
      headers['Access-Control-Allow-Origin'] = '*' 
      headers['Access-Control-Allow-Methods'] = 'POST, GET, OPTIONS' 
      headers['Access-Control-Allow-Headers'] = '*' 
      headers['Access-Control-Max-Age'] = '1728000' 
      render :text => '', :content_type => 'text/plain' 
     end 
     end 
     end 

Answer 1

您需要添加訪問控制頭在你的Rails應用程序，也可以直接改變方法「JSONP」按照這個線程：AngularJS: No "Access-Control-Allow-Origin" header is present on the requested resource

var req = { 
method: 'JSONP', 
url: 'http://localhost:3000/api/v1/dis_generics', 
headers: { 
    "Content-Type": "application/json" 
}, 
data: {} 
} 
$http(req).success(function(data, status, header, config) {