http - CORS Access-Control-Allow-Headers 通配符被忽略？

Question

我在使用 Chrome 获取跨域 CORS 请求时遇到问题。

请求 header :

Accept:*/*
Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Access-Control-Request-Headers:origin, content-type
Access-Control-Request-Method:POST
Connection:keep-alive
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1229.94 Safari/537.4

响应头:

Access-Control-Allow-Headers:*
Access-Control-Allow-Origin:*
Allow:GET, POST, OPTIONS
Content-Length:0
Date:Tue, 30 Oct 2012 20:04:28 GMT
Server:BaseHTTP/0.3 Python/2.7.3

错误:

XMLHttpRequest cannot load domain. Request header field Content-Type is not allowed by Access-Control-Allow-Headers.

服务于选项请求的 python 代码是:

self.send_response(200)
self.send_header('Allow', 'GET, POST, OPTIONS')
self.send_header('Access-Control-Allow-Origin', '*')
self.send_header('Access-Control-Allow-Headers', '*')
self.send_header('Content-Length', '0')
self.end_headers()

Access-Control-Allow-Origin 通配符似乎被忽略了？

Answer 1

Access-Control-Allow-Headers header 中对通配符的支持是 added to the living standard仅在 2016 年 5 月发布，因此可能并非所有浏览器都支持它。在尚未实现此功能的浏览器上，它必须完全匹配:https://www.w3.org/TR/2014/REC-cors-20140116/#access-control-allow-headers-response-header

如果您希望有大量 header ，您可以读入 Access-Control-Request-Headers header 的值并在 Access-Control-Allow 中回显该值- header header 。