javascript - XMLHttpRequest 将 POST 更改为 OPTION

Question

我有这个代码:

net.requestXHR = function() {
    this.xhr = null;
    if(window.XMLHttpRequest === undefined) {
        window.XMLHttpRequest = function() {
            try {
                // Use the latest version of the activex object if available
                this.xhr = new ActiveXObject("Msxml2.XMLHTTP.6.0");
            }
            catch(e1) {
                try {
                    // Otherwise fall back on an older version
                    this.xhr = new ActiveXObject("Mxsml2.XMLHTTP.3.0");
                }
                catch(e2) {
                    //Otherwise, throw an error
                    this.xhr = new Error("Ajax not supported in your browser");
                }
            }
        };
    }
    else
        this.xhr = new XMLHttpRequest();
}
net.requestXHR.prototype.post = function(url, data) {
    if(this.xhr != null) {
        this.xhr.open("POST", url);
        this.xhr.setRequestHeader("Content-Type", "application/json");
        this.xhr.send(data);
    }
}

    var rs = new net.requestSpeech();
    console.log(JSON.stringify(interaction));
    rs.post("http://localhost:8111", JSON.stringify(interaction));

当发送执行时，我有这个日志:

OPTIONS http://localhost:8111/ [HTTP/1.1 405 Method Not Allowed 74ms]

并且在 localhost:8111 中我有一个接受帖子的 reslet serverResource，这是同源策略的问题吗？我已经修改了 reSTLet 以放置 allow-origin header ，并且我使用另一个 GET http 请求(在 jquery 中)对其进行了测试并且工作正常。我有同源解决的问题，因为我使用 html5 浏览器并且我的服务器将 header 放在响应中，那么为什么发送显示这个错误？为什么将 POST 更改为 OPTION？谢谢!

Possible duplicate?: I think no, but it's true, the problem is the same for both questions, but mine are refers since the question that there is an issue with the browser, and the other, first points to jquery. By experience the time does not count for duplicate, the answers are different but it's true that both questions complement each other.

Answer 1

是的，这是“同源策略的问题”。您正在向不同的服务器或不同的端口发出请求，这意味着它是跨站点 HTTP 请求。这是the documentation不得不说这样的请求:

Additionally, for HTTP request methods that can cause side-effects on server's data (in particular, for HTTP methods other than GET, or for POST usage with certain MIME types), the specification mandates that browsers "preflight" the request, soliciting supported methods from the server with an HTTP OPTIONS request method, and then, upon "approval" from the server, sending the actual request with the actual HTTP request method.

CORS standard 中有更详细的描述(“带预检的跨源请求”部分)。您的服务器需要允许 OPTIONS 请求并发送带有 Access-Control-Allow-Origin、Access-Control-Allow-Headers 和Access-Control-Allow-Methods header 允许请求。然后浏览器将发出实际的 POST 请求。