CORS：內容類型不被訪問控制允許報頭中的預檢響應

Question

林建設使用的API vuejs和內腔中的應用程序允許，

嘗試驗證

當我vuejs程序是拋出一個錯誤

XMLHttpRequest無法加載http://api.dev/auth/login。請求標題字段Content-Type在預檢響應中不被Access-Control-Allow-Headers所允許。

我有一些中間件處理CORS

class cors { 

    /** 
    * @var array 
    */ 
    protected $settings = [ 
     'maxAge'   => 0, 
     'origin'   => '*', 
     'allowMethods'  => '*', 
     'exposeHeaders'  => '*', 
     'allowedHeaders' => '*' 
    ]; 

public function handle(ServerRequestInterface $request, Closure $next) 
{ 
    //handle preflight request 
    if ('OPTIONS' == $request->getMethod()) { 
     $response = new \Illuminate\Http\Response('',"204"); 
     $this->setOrigin($request, $response); 
     $this->setAllowHeaders($request,$response); 
     return $response; 
    } 
} 

/** 
* @param ServerRequestInterface $request 
* @param ResponseInterface $response 
*/ 
protected function setOrigin(ServerRequestInterface $request,$response) 
{ 
    $origin = $this->settings['origin']; 
    if (is_callable($origin)) { 
     $origin = call_user_func($origin,$response->withAddedHeader('Origin',$origin)); 
    } 
    $response->headers->set('Access-Control-Allow-Origin', $origin); 
} 

/** 
* @param ServerRequestInterface $request 
* @param ResponseInterface $response 
*/ 
protected function setAllowHeaders(ServerRequestInterface $request,$response) 
{ 
    if (isset($this->settings['allowedHeaders'])) { 
     $allowedHeaders = $this->settings['allowedHeaders']; 
     if (is_array($allowedHeaders)) { 
      $allowedHeaders = implode(", ", $allowedHeaders); 
     } 
    } 
    else { 
     $allowedHeaders = $request->hasHeader("Access-Control-Request-Headers"); 
    } 

    if (isset($allowedHeaders)) { 
     $response->headers->set('Access-Control-Allow-Headers', $allowedHeaders); 
    } 
} 
} 

在Chrome我響應報頭顯示

Access-Control-Allow-Headers:* 
Access-Control-Allow-Origin:* 
Cache-Control:no-cache 
Content-Type:text/html; charset=UTF-8 
Date:Mon, 10 Oct 2016 16:10:52 GMT 
Server:Caddy 
Status:204 No Content 
X-Powered-By:PHP/7.0.10 

如果我給自己定一個外卡接入控制允許頭爲何不能接受頭文件？

Answer 1

按照answer to this question，爲Access-Control-Allow-Headers通配符是相對較新的（2016年5月），所以它可能不是廣受大多數瀏覽器採用。

您應該準確定義要在預檢請求中允許使用哪些標頭。