允許選項方法與restify - 請求標頭字段授權不允許通過Access-Control-Allow-Headers在預檢響應中

Question

我正在使用restify框架編寫nodejs api應用程序。

我使Cors跨域訪問。

的RESTify配置了下面的代碼：

var restify = require('restify'), 
fs = require('fs'); 

var server = restify.createServer({ 
    certificate: fs.readFileSync(__dirname + '/config/keys/myalcoholist/server.crt'), 
key: fs.readFileSync(__dirname + '/config/keys/myalcoholist/server.key'), 
name: 'MyAlcoholist', 
}); 
function corsHandler(req, res, next) { 

res.setHeader('Access-Control-Allow-Origin', '*'); 
res.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, X-Response-Time, X-PINGOTHER, X-CSRF-Token'); 
res.setHeader('Access-Control-Allow-Methods', '*'); 
res.setHeader('Access-Control-Expose-Headers', 'X-Api-Version, X-Request-Id, X-Response-Time'); 
res.setHeader('Access-Control-Max-Age', '1000'); 

return next(); 
} 
function optionsRoute(req, res, next) { 

res.send(200); 
return next(); 
} 



server.use(restify.bodyParser()); 
server.use(restify.CORS({ 
origins: ['http://127.0.0.1', 'https://myalcoholist.com', 'https://www.myalcoholist.com'], // defaults to ['*'] 
credentials: true,     // defaults to false 
headers: ['x-foo'],     // sets expose-headers 
methods: ['GET','PUT','DELETE','POST','OPTIONS'] 
})); 

server.opts('/\.*/', corsHandler, optionsRoute); 

server.listen(8888, function() { 
console.log('%s listening at %s', server.name, server.url); 
}); 

，你可以看到我實現了一個corsHandler函數來處理OPTIONS請求。問題是，我遇到的是，當我訪問該API的NodeJS從https://myalcoholist.com我得到了我的谷歌Chrome瀏覽以下錯誤：

XMLHttpRequest cannot load https://myalcoholist.com:8888/cocktail/get_latest_drinks. Request header field Authorization is not allowed by Access-Control-Allow-Headers in preflight response. 

爲什麼我得到這個錯誤任何想法？

Answer 1

看來，答案很簡單，我需要將Authorization添加到允許的標題。使作品我corsHandler功能如下：

function corsHandler(req, res, next) { 

res.setHeader('Access-Control-Allow-Origin', '*'); 
res.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, X-Response-Time, X-PINGOTHER, X-CSRF-Token,Authorization'); 
res.setHeader('Access-Control-Allow-Methods', '*'); 
res.setHeader('Access-Control-Expose-Headers', 'X-Api-Version, X-Request-Id, X-Response-Time'); 
res.setHeader('Access-Control-Max-Age', '1000'); 

return next(); 
} 

Answer 2

能夠通過以下

var server = restify.createServer({ 
    name: "Test Server", 
    version: "2.0.1" 
}); 

function corsHandler(req, res, next) { 
    res.setHeader('Access-Control-Allow-Origin', '*'); 
    res.setHeader('Access-Control-Allow-Headers', 'Origin, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, X-Response-Time, X-PINGOTHER, X-CSRF-Token,Authorization'); 
    res.setHeader('Access-Control-Allow-Methods', '*'); 
    res.setHeader('Access-Control-Expose-Headers', 'X-Api-Version, X-Request-Id, X-Response-Time'); 
    res.setHeader('Access-Control-Max-Age', '1000'); 
    return next(); 
} 

function optionsRoute(req, res, next) { 
    res.send(200); 
    return next(); 
} 

server.use(restify.CORS({ 
credentials: true,     // defaults to false 
methods: ['GET','PUT','DELETE','POST','OPTIONS'] 
})); 

/* 
routes and authentication handlers 
*/ 

server.opts('/\.*/', corsHandler, optionsRoute); 
server.listen(serverPort, function() { 
    var consoleMessage = '\n Test Server'; 
} 

Answer 3

看來的RESTify已刪除解決選項MethodNotAllowed錯誤和CORS預檢問題與GET/POST的RESTify問題CORS直接支持，現在由插件restify-cors-middleware處理。