Question

这是跨源资源共享的背景。对于预检请求，服务器不发送标头集。如果未通过＆＃34;选项请求＆＃34;传递有效的Cookie，则其中的服务器响应不会发送我设置的标头，但是，它正在发送＆＃34; 200 OK＆＃34 ;.我用curl检查了这个，如下所示（显然，我用虚拟＆＃34替换了我的有效cookie; xyzabcde＆＃34;这里）

没有cookie的卷曲请求：

curl -H "Origin: app2_url"   -H "Access-Control-Request-Method: POST"   -H "Access-Control-Request-Headers: accept, origin, content-type"   -X OPTIONS --verbose   app1_url/jsonrpc.cgi

（发送以下回复......）

HTTP/1.1 200 OK
Date: Tue, 01 Oct 2013 11:37:36 GMT
Server: Apache
Expires: Tue, 01 Oct 2013 11:37:36 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Expires: Tue, 01 Oct 2013 11:37:36 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 4531
Content-Type: text/html; charset=utf-8

使用＆＃34; -H Cookie：xyzabcde＆＃34;：

curl -H "Origin: app2_url"   -H "Access-Control-Request-Method: POST"   -H "Access-Control-Request-Headers: accept, origin, content-type" "-H Cookie:xyzabcde"  -X OPTIONS --verbose   app1_url/jsonrpc.cgi

（发送以下回复......）

HTTP/1.1 403 Forbidden
Date: Wed, 02 Oct 2013 18:48:34 GMT
Server: Apache
X-frame-options: ALLOW-FROM app2_url
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: accept, origin, content-type, Man, Messagetype, Soapaction, X-Requested-With
Access-Control-Allow-Methods: GET, POST, HEAD, PUT, OPTIONS
Access-Control-Allow-Origin: app2_url
Access-Control-Max-Age: 1800
Transfer-Encoding: chunked
Content-Type: application/json; charset=UTF-8

apache配置看起来像......

<VirtualHost *:443>
.
.
Header always set X-Frame-Options "ALLOW-FROM app2_url"
Header  always set  Access-Control-Allow-Credentials "true"
Header  always set  Access-Control-Allow-Headers    "accept, origin, content-type, Man, Messagetype, Soapaction, X-Requested-With"
Header  always set  Access-Control-Allow-Methods    "GET, POST, HEAD, PUT, OPTIONS"
Header  always set  Access-Control-Allow-Origin    "app2_url"
Header  always set  Access-Control-Max-Age  "1800"
.
.
.
<Directory /app1/dir/>      
    Options Includes FollowSymLinks ExecCGI MultiViews
    AllowOverride None
    Order allow,deny
    allow from all
    AuthType Net
    PubcookieInactiveExpire -1
    PubcookieAppID app1.company.com
    require valid-user
</Directory>
.
.
</VirtualHost>

如何发送所有标头以响应未经身份验证的请求？我想，理想情况下，Options请求不需要任何身份验证。

Answer 1

我们用不同的配置解决了这个问题。以下是位于/ usr / local / apache / conf / extra上的myApplication.conf文件的片段

    <Location "/myService">
      SetEnvIf Request_URI "/healthCheck" REDIRECT_noauth=1
      SetEnvIf Request_Method "OPTIONS" REDIRECT_noauth=1
      AuthType Basic
      AuthName "myService"
      AuthUserFile /usr/local/apache/conf/passwd/passwords
      AuthGroupFile /usr/local/apache/conf/passwd/groups
      Require group GroupName
      Order allow,deny
      Allow from env=REDIRECT_noauth
      Satisfy any
   </Location>

因此，我们可以绕过身份验证：

基于特定的URI，在上面的示例中，/ healthCheck被绕过
基于HTTP方法，在上面的示例中，OPTIONS被绕过，并且会提示auth要求其他HTTP方法

希望它可以帮助某人解决问题。

Answer 2

“LimitExcept”指令解决了它。实际上，在发布问题之前我尝试了该指令，但之前的错误是在“LimitExcept”块中包含前两行（“Options Includes ...”和“Alowoverride ...”）。

<Directory /app1/dir/>      
  Options Includes FollowSymLinks ExecCGI MultiViews
  AllowOverride None
  <LimitExcept OPTIONS>
    Order allow,deny
    allow from all
    AuthType Net
    PubcookieInactiveExpire -1
    PubcookieAppID app1.company.com
    require valid-user
  </LimitExcept> #<- syntax error fixed.
</Directory>

绕过“选项请求”的身份验证（以便在响应中发送所有标头）

2 个答案: