在後端添加Access-Control-Allow-Origin頭後，爲什麼會出現cors問題？

Question

我正在對不同的域進行ajax調用。我的團隊成員將Access-Control-Allow-Origin標頭添加到http://localhost:3000。

$.ajax({ 
      type: 'GET', 
      url: myurl, 
      beforeSend: function(xhr) { 
       xhr.setRequestHeader('Authorization', 'Bearer '+authorization); 
      }, 
      crossDomain: true, 
      // xhrFields: { 
      // withCredentials: true 
      // }, 
      contentType: 'application/json', 
      dataType: 'JSON', 
      success: function (response) { 
      if(time_one === 0){ 
       main_result = response; 
       time_one++; 
      } 
      if(response.length==0){ 
       alert("NO Data; Try a valid search") 
       $('.row3, #paging').hide(); 
       $('.loading-gif').show(); 
       $('#table').html(''); 
       myCallBack(main_result); 
      } 
      else{ 
       $('#table').html('') 
       myCallBack(response); 
      } 
      }, 
      error: function(err) { 
      $('.loading-gif').hide(); 
      $(".pageblocker").hide(); 
      alert('Error: '+JSON.stringify(err)); 
      myCallBack(main_result) 
      } 
     }); 

如果我嘗試這種方式，我越來越'Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access.'我不明白爲什麼我即使添加了ACAO頭之後得到這樣的錯誤類型。

而且我還注意到另一個錯誤，如果我添加'withCredentials'屬性。 ' 'Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin 'http://localhost:3000' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.'我不明白這兩個錯誤之間的區別。

Answer 1

服務器myurl必須返回Access-Control-Allow-Origin響應標頭。

如果您無權訪問myurl服務器的服務器環境以將該服務器配置爲發送Access-Control-Allow-Origin響應標頭，那麼您需要通過代理進行請求。您可以在"No 'Access-Control-Allow-Origin' header is present on the requested resource"的答案中找到有關設置該類代理的更多詳細信息。

反正事實添加Access-Control-Allow-Origin到http://localhost:3000後端具有在這種情況下沒有效果，預計-因爲Access-Control-Allow-Origin是響應頭必須由一個請求到由服務器發送。 http://localhost:3000不是這樣 - 它是服務於啓動請求的前端JavaScript代碼的服務器。

https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS是瞭解所有這些東西如何工作的最佳資源。這裏其他一些答案看一看：

• Angular 2 HTTP POST returns data but goes to error (cors)
• Why isn't rack-cors filtering incoming requests, according to Rspec
• Will ASP.net Core CORS policy prevent resource access from non-browser requests?
• CORS is a double system checking?