假设我有两台服务器：服务器A和服务器B.服务器A托管以下页面：
<html>
<head>
<script type="text/javascript">
var http = new XMLHttpRequest();
console.log("XML Request object created.");
http.open("POST", 'https://serverb.com/file', true, 'user', 'pass');
http.onreadystatechange = function() {
console.log("readystatechange: "+http.status+":"+http.readyState);
if (http.status == 200 && http.readyState == 4) {
alert(http.responseText);
}
}
http.send();
console.log("http request sent.");
</script>
</head>
</html>
使用以下Apache2配置：
LoadModule ssl_module modules/mod_ssl.so
LoadModule headers_module modules/mod_headers.so
Listen 443
<VirtualHost *:443>
Header always append Access-Control-Allow-Origin: "*"
Header set Access-Control-Allow-Credentials true
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLEngine on
SSLCertificateFile "/home/vtcakavsmoace/Documents/webpass/cert.pem"
SSLCertificateKeyFile "/home/vtcakavsmoace/Documents/webpass/key.pem"
</VirtualHost>
服务器B托管一个名为“file”的文件，并具有以下Apache2配置：
LoadModule ssl_module modules/mod_ssl.so
LoadModule headers_module modules/mod_headers.so
Listen 443
<VirtualHost *:443>
Header always append Access-Control-Allow-Origin: "*"
Header set Access-Control-Allow-Credentials true
ServerAdmin webmaster@localhost
DocumentRoot /var/www/files
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
<Directory "/var/www/files">
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Directory>
</VirtualHost>
服务器需要使用密码为“pass”的名为“user”的用户进行HTTP身份验证。
但是，只要有人连接到服务器A，就会出现以下错误：
NS_ERROR_DOM_BAD_URI: Access to restricted URI denied
表示Access-Control-Allow-Origin不在标题中。对于任一服务器，情况都不是这样。如果不是问题，我也尝试通过命令行来卷曲信息，这成功了。我还尝试将http.open行更改为：
http.open("POST", 'https://user:pass@serverb.com/file', true);
但这也失败了。
我在这里做错了什么？
修改
如果有帮助，这里是curl --verbose --head -u 'user:pass' https://serverb.com/file的输出：
* Trying <redacted>...
* Connected to <redacted> (<redacted>) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 697 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
* server certificate verification OK
* server certificate status verification SKIPPED
* common name: <redacted> (matched)
* server certificate expiration date OK
* server certificate activation date OK
* certificate public key: RSA
* certificate version: #3
* subject: OU=<redacted>,OU=See www.rapidssl.com/resources/cps (c)15,OU=Domain Control Validated - RapidSSL(R),CN=<redacted>
* start date: Wed, 06 May 2015 13:02:37 GMT
* expire date: Mon, 08 May 2017 08:52:24 GMT
* issuer: C=US,O=GeoTrust Inc.,CN=RapidSSL SHA256 CA - G3
* compression: NULL
* ALPN, server did not agree to a protocol
* Server auth using Basic with user '<redacted>'
> HEAD /<redacted>/file HTTP/1.1
> Host: <redacted>
> Authorization: Basic <redacted>
> User-Agent: curl/7.47.0
> Accept: */*
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Wed, 10 Aug 2016 11:30:36 GMT
Date: Wed, 10 Aug 2016 11:30:36 GMT
< Server: Apache/2.4.7 (Ubuntu)
Server: Apache/2.4.7 (Ubuntu)
< Access-Control-Allow-Origin: *
Access-Control-Allow-Origin: *
< Last-Modified: Tue, 09 Aug 2016 11:36:29 GMT
Last-Modified: Tue, 09 Aug 2016 11:36:29 GMT
< ETag: "<redacted>"
ETag: "<redacted>"
< Accept-Ranges: bytes
Accept-Ranges: bytes
< Content-Length: 45377
Content-Length: 45377
< Access-Control-Allow-Credentials: true
Access-Control-Allow-Credentials: true
< Content-Type: application/<redacted>
Content-Type: application/<redacted>
<
* Connection #0 to host <redacted> left intact
编辑2：
我进一步改变了代码。网页中的脚本现在如下：
var http = new XMLHttpRequest();
console.log("XML Request object created.");
http.open("POST", 'https://serverb.com/file', true);
http.withCredentials = true;
http.setRequestHeader('Authorization', 'Basic '+btoa('user:pass'));
http.onreadystatechange = function() {
console.log("readystatechange: "+http.status+":"+http.readyState);
if (http.status == 200 && http.readyState == 4) {
alert(http.responseText); }
}
http.send();
console.log("http request sent.");
现在，我得到401状态服务器端和0状态客户端，而不是简单地拒绝该请求，这意味着凭据不正确，即使它们是正确的。
编辑3：
以下编辑会在Chrome中打开身份验证窗格，但在Firefox中，会引发NS_ERROR_DOM_BAD_URI: Access to restricted URI denied错误。
var http = new XMLHttpRequest();
console.log("XML Request object created.");
http.open("GET", 'https://serverb.com/file', true, 'user', 'pass');
http.withCredentials = true;
http.onreadystatechange = function() {
console.log("readystatechange: "+http.status+":"+http.readyState);
if (http.status == 200 && http.readyState == 4) {
alert(http.responseText);
}
}
http.send();
console.log("http request sent.");
答案 0 :(得分：0)
好的，所以，我想出了一些解决方法。
由于CORS导致我.navbar-nav{
text-align:center;
}
.navbar-nav>li {
float: none;
display: inline-block;
}
问题，我摆脱了CORS并开始在Apache2配置中代理请求。
index.html最终版本：
NS_ERROR_DOM_BAD_URI: Access to restricted URI denied服务器A最终配置：
<html>
<head>
<script type="text/javascript">
var http = new XMLHttpRequest();
console.log("XML Request object created.");
http.open("POST", 'file', true);
http.onreadystatechange = function() {
console.log("readystatechange: "+http.status+":"+http.readyState);
if (http.status == 200 && http.readyState == 4) {
alert(http.responseText);
}
}
http.send();
console.log("http request sent.");
</script>
</head>
</html>
服务器B最终配置：
LoadModule ssl_module modules/mod_ssl.so
LoadModule headers_module modules/mod_headers.so
LoadModule rewrite_module modules/mod_rewrite.c
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule auth_basic_module modules/mod_auth_basic.c
Listen 443
<VirtualHost *:443>
Header always append Access-Control-Allow-Origin: "*"
Header set Access-Control-Allow-Credentials true
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLEngine on
SSLCertificateFile "/path/to/cert.pem"
SSLCertificateKeyFile "/path/to/key.pem"
ProxyRequests Off
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
SSLProxyEngine On
SSLProxyCheckPeerCN on
SSLProxyCheckPeerExpire on
# Adding a prefix for googling purposes.
ProxyPassMatch "^/(prefix.*file.*.jpg)$" "https://serverb.com/$1"
ProxyPassReverse "/" "https://serverb.com/"
<LocationMatch "^/prefix.*file.*.jpg$">
# Pass the credentials
AuthBasicFake "user" "pass"
Order allow,deny
Allow from all
</LocationMatch>
</VirtualHost>
此方法的另一个好处是最终用户永远不会看到密码，因此没有授权披露。