javascript - Cors 问题仅在 "put"时发生？

Question

我正在构建一个使用 ng-resource 的 Angular 应用程序。服务 API 内置于 Asp.Net Core web api 中，并且已经启用了 CORS。

service.js代码

.factory('D2Service', ['$resource', function ($resource) {
    return $resource('http://localHost:5001/api/D2/:id',
        { id: '@id' },
        {
            update: { method: 'PUT' }
        });
}])

但是，在 Controller 中调用D2Service.update(model.d); 出现了以下错误。

XMLHttpRequest cannot load http://localhost:5001/api/D2. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:8082' is therefore not allowed access.

但是 D2Service.get({ id: model.id }).. 运行没有任何错误。为什么“PUT”有 CORS 问题而“GET”没有问题？

以下是使用fiddler监控时的request/response

要求:

OPTIONS http://localhost:5001/api/D2 HTTP/1.1
Host: localhost:5001
Connection: keep-alive
Access-Control-Request-Method: PUT
Origin: http://localhost:8082
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36
Access-Control-Request-Headers: content-type
Accept: */*
Referer: http://localhost:8082/
Accept-Encoding: gzip, deflate, sdch, br
Accept-Language: en-US,en;q=0.8

响应:

HTTP/1.1 204 No Content
Date: Sun, 27 Nov 2016 23:32:31 GMT
Server: Kestrel

Answer 1

要使预检请求正常工作，您的响应中应该包含以下 header :

Access-Control-Allow-Origin: YOUR_DOMAIN
Access-Control-Request-Method: PUT
Access-Control-Request-Headers: YOUR_CUSTOM_HEADERS