CORS：當(dāng)憑據(jù)標(biāo)志為真時(shí)，無法在訪問控制允許原產(chǎn)地中使用通配符我有個(gè)計(jì)劃前端服務(wù)器(Node.js，域：localhost：3000)<->后端(Django，Ajax，Domain：localhost：8000)Browser<-webapp<-Node.js(為應(yīng)用程序服務(wù))Browser(Webapp)->ajax->Django(服務(wù)Ajax POST請求)現(xiàn)在，我的問題是使用CORS設(shè)置，Webapp用來對后端服務(wù)器進(jìn)行Ajax調(diào)用。在鉻，我不斷得到當(dāng)憑據(jù)標(biāo)志為真時(shí)，無法在訪問控制-允許-原產(chǎn)地中使用通配符。火狐也不起作用。我的Node.js設(shè)置是：var allowCrossDomain = function(req, res, next) {
res.header('Access-Control-Allow-Origin', 'http://localhost:8000/');
res.header('Access-Control-Allow-Credentials', true);
res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
next();};在Django，我用這個(gè)中間件 還有這個(gè)Web應(yīng)用程序以這樣的方式提出請求：$.ajax({
type: "POST",
url: 'http://localhost:8000/blah',
data: {},
xhrFields: {
withCredentials: true
},
crossDomain: true,
dataType: 'json',
success: successHandler});因此，Web應(yīng)用程序發(fā)送的請求頭如下所示：Access-Control-Allow-Credentials: trueAccess-Control-Allow-Headers: "Origin, X-Requested-With, Content-Type,
Accept"Access-Control-Allow-Methods: 'GET,PUT,POST,DELETE'Content-Type: application/json
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: csrftoken=***; sessionid="***"下面是響應(yīng)頭：Access-Control-Allow-Headers: Content-Type,*Access-Control-Allow-Credentials: trueAccess-Control-Allow-Origin:
*Access-Control-Allow-Methods: POST,GET,OPTIONS,PUT,DELETEContent-Type: application/json我哪里出問題了？！編輯1：我一直在使用chrome --disable-web-security，但現(xiàn)在想讓事情真正發(fā)揮作用。編輯2：回答：所以，我的解決方案django-cors-headers配置：CORS_ORIGIN_ALLOW_ALL = FalseCORS_ALLOW_CREDENTIALS = TrueCORS_ORIGIN_WHITELIST = (
'http://localhost:3000' # Here was the problem indeed and it has to be http://localhost:3000, not http://localhost:3000/)
CORS：當(dāng)憑據(jù)標(biāo)志為真時(shí)，無法在訪問控制允許原產(chǎn)地中使用通配符
德瑪西亞99
2019-06-20 17:16:38
