Question

我已经深入研究了CORS配置。浏览器尝试在发送"real"请求之前请求发送CORS请求的有效请求配置。我的服务器应用已配置CORSFilter，并且已经响应了这些请求。不过，响应是200 - OK代码，但"real"请求未发送。

到目前为止，我已经明白了，当CORS request为200-OK时，浏览器必须发送"real"请求，不应该？

当我到达this.http.request(path, requestOptions)时，发送了CORS请求：

curl "http://localhost:8082/commty/cmng/users" -X OPTIONS -H "Host: localhost:8082" -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" -H "Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3" --compressed -H "Access-Control-Request-Method: PUT" -H "Access-Control-Request-Headers: passwd,user" -H "Origin: http://localhost:3000" -H "Connection: keep-alive"

和响应标题：

HTTP/1.1 200 OK X-Powered-By: Undertow/1 Access-Control-Allow-Headers: origin, content-type, accept, authorization Server: WildFly/10 Date: Fri, 09 Dec 2016 07:50:55 GMT Allow: HEAD, GET, OPTIONS, PUT Connection: keep-alive Access-Control-Allow-Origin: * access-control-allow-credentials: true Content-Type: text/plain Content-Length: 23 Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 1209600

有什么问题我不明白吗？

为什么浏览器没有发送"real"请求？

修改

当我尝试发送PUT请求（typescript fragemnt code）时，此链开始：

/**
     * User exists
     * 
     * @param user username
     */
    public existsWithHttpInfo(user: string, extraHttpRequestParams?: any): Observable<Response> {
        const path = this.basePath + `/users`;

        let queryParameters = new URLSearchParams();
        let headers = new Headers(this.defaultHeaders.toJSON()); // https://github.com/angular/angular/issues/6845
        // verify required parameter 'user' is not null or undefined
        if (user === null || user === undefined) {
            throw new Error('Required parameter user was null or undefined when calling exists.');
        }

        headers.set('user', String(user));

        // to determine the Content-Type header
        let consumes: string[] = [
        ];

        // to determine the Accept header
        let produces: string[] = [
            'application/json'
        ];





        let requestOptions: RequestOptionsArgs = new RequestOptions({
            method: RequestMethod.Get,
            headers: headers,
            search: queryParameters
        });

        // https://github.com/swagger-api/swagger-codegen/issues/4037
        if (extraHttpRequestParams) {
            requestOptions = this.extendObj(requestOptions, extraHttpRequestParams);
        }

        return this.http.request(path, requestOptions);
    }

CorsFilter：

@Provider
public class CORSFilter implements ContainerResponseFilter
{

    @Override
    public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) throws IOException
    {   
        responseContext.getHeaders().add("Access-Control-Allow-Origin", "*");
        responseContext.getHeaders().add("Access-Control-Allow-Headers", "origin, content-type, accept, authorization");
        responseContext.getHeaders().add("Access-Control-Allow-Credentials", "true");
        responseContext.getHeaders().add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, HEAD");
        responseContext.getHeaders().add("Access-Control-Max-Age", "1209600");
    }

}

错误消息

Object {
  _body: error,
  status: 0,
  ok: false,
  statusText: "",
  headers: Object,
  type: 3,
  url: null
}

Answer 1

因为您正在使用：

responseContext.getHeaders().add("Access-Control-Allow-Credentials", "true");

您不能使用通配符作为原点。将其更改为：

responseContext.getHeaders().add("Access-Control-Allow-Origin", "my.frontend.com");

浏览器没有发送请求（CORS配置）

1 个答案: