Question

现在我遇到CORS（跨域资源共享）问题，特别是在尝试向slim api发送授权时。我试图删除jquery上的授权标题，它就像一个魅力！但我需要授权传递api密钥，我不知道如何绕过预检模式（OPTIONS）。这是javascript代码。

$.ajax({
    type:'GET',
    url:baseApi+'/code/account',
    crossDomain:true,
    xhrFields:{
        withCredentials:true
    },
    beforeSend:function(xhr){
        $overlay.css('display','block');
        xhr.setRequestHeader("Authorization",boot._header);
    },
    complete:function(xhr){
        // complete scope        
    }
});

在slim框架上，我已将Access-Control-Allow-Origin设置为白名单原始域（www.example.com）。这是完整的配置

if (isset($_SERVER['HTTP_ORIGIN'])) {
    if($_SERVER['HTTP_ORIGIN'] == "http://www.example.com"){
        header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
    }
    header('Access-Control-Allow-Credentials: true');
    header('Access-Control-Max-Age: 86400');    // cache for 1 day
}

if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {

    if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']))
        header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS");

    if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']))
        header("Access-Control-Allow-Headers: Authorization, authorization, Content-Type");
}

以下是完整的请求和响应标题

响应标题

HTTP/1.1 404 Not Found
Date: Tue, 14 Feb 2017 14:44:34 GMT
Server: Apache/2.4.23 (Unix) OpenSSL/1.0.2h PHP/5.6.24 mod_perl/2.0.8-dev Perl/v5.16.3
X-Powered-By: PHP/5.6.24
Access-Control-Allow-Origin: http://www.example.com
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Authorization, authorization
Content-Length: 514
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html;charset=UTF-8

请求标题

OPTIONS /code/account HTTP/1.1
Host: api.example.com
Connection: keep-alive
Access-Control-Request-Method: GET
Origin: http://www.example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Access-Control-Request-Headers: authorization
Referer: http://www.example.com/account/payout
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,id;q=0.6,ms;q=0.4
Accept: */*

我尝试过其他人的可能解决方案，但没有机会解决这个问题。始终显示404，调用OPTIONS方法，而不是像它应该的GET方法。

Answer 1

经过研究和调查，我最终使用了@Mika Tuupola建议的Slim CORS中间件。但由于我使用的是Slim v2，这个回购https://github.com/palanik/CorsSlim适合我。如果您使用的是Slim v3，请使用由我们的救世主创建的repo https://github.com/tuupola/cors-middleware。希望它有所帮助！

Answer 2

对于Slim Framework 2.4版本，我做了一个小小的黑客来处理Preflight OPTIONS请求

\Slim\Slim::registerAutoloader();

$app = new \Slim\Slim();
    if($app->request->isOptions()) {
        return true;
        break;
    }
    $app->post('/authenticate', 'authenticateUser');

$app->run();

因此，这将跟踪所有OPTIONS请求并返回true，这对我有用。

我的.htaccess文件如下所示

Header add Access-Control-Allow-Origin "*"
Header add Access-Control-Allow-Headers "X-Requested-With, Content-Type, Accept, Origin, Authorization"
Header add Access-Control-Allow-Methods "GET, POST, OPTIONS"

希望这有帮助。

在Slim框架上的CORS期间预检授权头

2 个答案: