如何在Chrome中修复Amazon-Cloudfront中的CORS错误

Question

仅当开发者控制台关闭时，Google Chrome浏览器才会产生CORS错误。但是，为什么在开发者控制台打开的情况下刷新同一网页时，为什么它能起作用？

我们在s3存储桶中设置了以下CORS设置：

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
    <AllowedOrigin>*</AllowedOrigin>
    <AllowedMethod>GET</AllowedMethod>
    <AllowedMethod>PUT</AllowedMethod>
    <AllowedMethod>POST</AllowedMethod>
    <AllowedMethod>DELETE</AllowedMethod>
    <AllowedMethod>HEAD</AllowedMethod>
    <AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>

我们还转发了所需的cloudfront标头：

当前行为：

在开发者控制台关闭的情况下首次访问该网站时，我们看不到图片。加载后打开开发人员控制台时，我们看到以下错误消息：

Access to image at 'https://devcdn.player360.de/testfred/media-960-thumb.png' from origin 'https://testfred.player-360-dev.de' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

为了测试它，我们创建了一个卷曲请求，其起源为：

C:\Users\Robin Mobfish>curl -H "Origin: https://testfred.player-360-dev.de" --verbose https://devcdn.player360.de/testfred/media-960-thumb.png
*   Trying 143.204.247.73...
* TCP_NODELAY set
* Connected to devcdn.player360.de (143.204.247.73) port 443 (#0)
* schannel: SSL/TLS connection with devcdn.player360.de port 443 (step 1/3)
* schannel: checking server certificate revocation
* schannel: sending initial handshake data: sending 184 bytes...
* schannel: sent initial handshake data: sent 184 bytes
* schannel: SSL/TLS connection with devcdn.player360.de port 443 (step 2/3)
* schannel: encrypted data got 3945
* schannel: encrypted data buffer: offset 3945 length 4096
* schannel: sending next handshake data: sending 126 bytes...
* schannel: SSL/TLS connection with devcdn.player360.de port 443 (step 2/3)
* schannel: encrypted data got 242
* schannel: encrypted data buffer: offset 242 length 4096
* schannel: SSL/TLS handshake complete
* schannel: SSL/TLS connection with devcdn.player360.de port 443 (step 3/3)
* schannel: stored credential handle in session cache
> GET /testfred/media-960-thumb.png HTTP/1.1
> Host: devcdn.player360.de
> User-Agent: curl/7.55.1
> Accept: */*
> Origin: https://testfred.player-360-dev.de
>
* schannel: client wants to read 102400 bytes
* schannel: encdata_buffer resized 103424
* schannel: encrypted data buffer: offset 0 length 103424
* schannel: encrypted data got 26951
* schannel: encrypted data buffer: offset 26951 length 103424
* schannel: decrypted data length: 631
* schannel: decrypted data added: 631
* schannel: decrypted data cached: offset 631 length 102400
* schannel: encrypted data length: 26291
* schannel: encrypted data cached: offset 26291 length 103424
* schannel: decrypted data length: 16384
* schannel: decrypted data added: 16384
* schannel: decrypted data cached: offset 17015 length 102400
* schannel: encrypted data length: 9878
* schannel: encrypted data cached: offset 9878 length 103424
* schannel: decrypted data length: 9849
* schannel: decrypted data added: 9849
* schannel: decrypted data cached: offset 26864 length 102400
* schannel: encrypted data buffer: offset 0 length 103424
* schannel: decrypted data buffer: offset 26864 length 102400
* schannel: schannel_recv cleanup
* schannel: decrypted data returned 26864
* schannel: decrypted data buffer: offset 0 length 102400
< HTTP/1.1 200 OK
< Content-Type: image/png
< Content-Length: 26233
< Connection: keep-alive
< Date: Thu, 28 Mar 2019 09:31:49 GMT
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: GET, PUT, POST, DELETE, HEAD
< Last-Modified: Thu, 30 Aug 2018 09:47:03 GMT
< ETag: "f2729ac9616c2f9d6a5a6705b330326f-1"
< x-amz-version-id: null
< Accept-Ranges: bytes
< Server: AmazonS3
< Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
< Age: 116
< X-Cache: Hit from cloudfront
< Via: 1.1 7a024d32abd1bf1da267d76e57a01fa1.cloudfront.net (CloudFront)
< X-Amz-Cf-Id: C5lvz2f_6A0xSuzzbkFiiaYbXkQ09ni0stov09ila670iBAQQYTo9w==
<
Warning: Binary output can mess up your terminal. Use "--output -" to tell
Warning: curl to output it to your terminal anyway, or consider "--output
Warning: <FILE>" to save to a file.
* Failed writing body (0 != 16384)
* Closing connection 0
* schannel: shutting down SSL/TLS connection with devcdn.player360.de port 443
* schannel: clear security context handle

响应显示存在所请求源的标头“ Access-Control-Allow-Origin”。

如果我们现在在打开开发者控制台的情况下刷新浏览器，则会显示图像 ，并且以后该图像将不再发生错误。

可能是什么问题，为什么只有在关闭了开发人员控制台的页面的第一次调用时总会出现CORS错误？