OData端点配置

// inside configuration
config.EnableCors();

// controllers
[EnableCors(origins: "*", headers: "*", methods: "*")]
[Authorize]
[HttpPost]
public void ...

从我的MVC客户端，使用Angular $http我们使用 Bearer token 发出经过身份验证的请求，该请求如下所示：

发送请求

Request URL:http://myodata.com/Products
Request Method:GET
Status Code:200 OK
Remote Address:123.123.123.123

这是发送的标题

Host: myodata.com
Authorization: bearer 123-ABC
Origin: http://myclient.com
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
Referer: http://myclient.com/

问题在于响应，如您所见：

HTTP/1.1 200 OK
Access-Control-Allow-Origin: *

因为从5.2.2升级到5.2.3后，CORS模块正在发送Access-Control-Allow-Origin: *

显然，从浏览器中我们得到了这个错误：

XMLHttpRequest cannot load http://myodata.com/Products. 
The value of the 'Access-Control-Allow-Origin' header 
in the response must not be the wildcard '*' 
when the request's credentials mode is 'include'. 
Origin 'http://myclient.com' is therefore not allowed access. 
The credentials mode of requests initiated by the XMLHttpRequest 
is controlled by the withCredentials attribute.

但实际上呼叫成功，它在Angular方面遭到轰炸。在我们从5.2.2升级到5.2.3

之后，直到今天我们还没有遇到这个问题

Answer 1

您可以尝试的一件事是使用URL Rewrite Module设置标头，方法是将以下内容添加到Web.config中的ApplicationHost.config或%SystemDrive%\inetpub\wwwroot\文件中。

<configuration> 
    <system.webServer> 
        <rewrite> 
            <outboundRules> 
                <rule name="Make Access-Control-Allow-Origin echo Origin"> 
                    <match serverVariable="RESPONSE_Access-Control-Allow-Origin"
                           pattern=".+" negate="true" /> 
                    <action type="Rewrite" value="{HTTP_ORIGIN}" /> 
                </rule> 
            </outboundRules> 
        </rewrite> 
    </system.webServer> 
</configuration>

如果以上操作不起作用，那么您可以在CORS in IIS issue with credentials and wildcard in Access-Control-Allow-Origin处的答案中试用该版本。

另一种尝试方法是in the global.asax or other code for your service, add something like：

if (ValidateRequest()) {
    Response.Headers.Remove("Access-Control-Allow-Origin");
    Response.AddHeader("Access-Control-Allow-Origin", Request.Headers["origin"]);
    Response.Headers.Remove("Access-Control-Allow-Credentials");
    Response.AddHeader("Access-Control-Allow-Credentials", "true");
    Response.Headers.Remove("Access-Control-Allow-Methods");
    Response.AddHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
}

......最重要的部分就是：

Response.AddHeader("Access-Control-Allow-Origin", Request.Headers["origin"]);

在任何一种情况下，最终结果都应该是您的后端获取Origin请求标头的值，并将其作为Access-Control-Allow-Origin响应标头的值回显。

在升级到asp.net 5.2.3之后，CORS并不适用于＆＃34; *＆＃34;起源

OData端点配置

发送请求

1 个答案: