Question

我添加了一个CORS中间件，它适用于单个路由： -

Route::get('example', ['middleware' => 'cors', function(){
    return Response::json(array('name' => 'Steve Jobs', 'company' => 'Apple'));
}]);

但是当我将它应用于路由组时，它在控制台中出错： -

(index):1 XMLHttpRequest cannot load http://jotdot.mysite.com/api/authenticate. 
Response to preflight request doesn't pass access control 
check: No 'Access-Control-Allow-Origin' header is present on 
the requested  resource. Origin 'http://jotdotfrontend.mysite.com' is
therefore not allowed access.

我的路线组： -

Route::group(['middleware' => 'cors'], function () {
Route::group(['prefix' => 'api'], function()
{
    Route::resource('authenticate', 'AuthenticateController', ['only' => ['index']]);
    Route::post('authenticate', 'AuthenticateController@authenticate');
});
});

Cors.php

class CORS
{
/**
 * Handle an incoming request.
 *
 * @param  \Illuminate\Http\Request  $request
 * @param  \Closure  $next
 * @return mixed
 */
public function handle($request, Closure $next)
{
    header("Access-Control-Allow-Origin: *");

    // ALLOW OPTIONS METHOD
    $headers = [
        'Access-Control-Allow-Methods'=> 'POST, GET, OPTIONS, PUT, DELETE',
        'Access-Control-Allow-Headers'=> 'Content-Type, X-Auth-Token, Origin'
    ];
    if($request->getMethod() == "OPTIONS") {
        // The client-side application can set only headers allowed in Access-Control-Allow-Headers
        return Response::make('OK', 200, $headers);
    }

    $response = $next($request);
    foreach($headers as $key => $value)
        $response->header($key, $value);
    return $response;
    return $next($request);
}
}

我正在关注https://scotch.io/tutorials/token-based-authentication-for-angularjs-and-laravel-apps并尝试在不同的域上设置后端和前端。

由于

Answer 1

问题在于，基于路由的中间件从未应用于基于自动生成OPTIONS的路由的resource请求（因为Route::resource(...)没有生成路由options方法？）。

因此，将您的cors中间件放在app/Http/Kernel.php中的全局中间件组中，就在VerifyCsrfToken中间件之前：

/**
 * The application's global HTTP middleware stack.
 *
 * @var array
 */
protected $middleware = [
    \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
    \Ankh\Http\Middleware\EncryptCookies::class,
    \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
    \Illuminate\Session\Middleware\StartSession::class,
    \Illuminate\View\Middleware\ShareErrorsFromSession::class,
    \App\Http\Middleware\CORS::class, // here it is
    \App\Http\Middleware\VerifyCsrfToken::class,
];

并将其从routes.php中完全删除，例如：

// Route::group(['middleware' => 'cors'], function () {
Route::group(['prefix' => 'api'], function() {
    Route::resource('authenticate', 'AuthenticateController', ['only' => ['index']]);
    Route::post('authenticate', 'AuthenticateController@authenticate');
});
//});

Answer 2

你可以试试这个：

Route::group(['prefix' => 'api', 'middleware' => 'cors'], function()
{
    Route::resource('authenticate', 'AuthenticateController', ['only' => ['index']]);
    Route::post('authenticate', 'AuthenticateController@authenticate');
});

Answer 3

试试这个，

Route::group([ 'prefix' => 'api', 'middleware' => 'App\Http\Middleware\CORS'], function() {
     Route::resource('authenticate', 'AuthenticateController', ['only' => ['index']]);
     Route::post('authenticate', 'AuthenticateController@authenticate');

});

Answer 4

您的原始标题不在标题数组中。不要使用header（）设置您的原始标题，而是尝试将其与您的其他访问控制标题一起添加：

// ALLOW OPTIONS METHOD
$headers = [
    'Access-Control-Allow-Origin'=> '*',
    'Access-Control-Allow-Methods'=> 'POST, GET, OPTIONS, PUT, DELETE',
    'Access-Control-Allow-Headers'=> 'Content-Type, X-Auth-Token, Origin'
];

为什么Laravel中间件适用于单个路由但不适用于路由组

4 个答案: