javascript - CORS - 预检请求后发出的请求期望 'Access-Control-Allow-Credentials' 为真

Question

一如既往，我会尽可能地把我的问题说得甜美而干净。

我必须将 CORS 作为需求请求发送，我正在通过 $.ajax 进行发送，它看起来像这样:

$.ajaxSetup({
        beforeSend: function (jqXHR, options) {
            options.url = Utils.setUrlHostname(options.url);
            options.xhrFields = {
                withCredentials: true
            };
            jqXHR.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
        }
    });

在服务器端(php - zend 框架)我正在处理这样的 header :

public function OPTIONS_ProxyAction()
    {
        $this->getResponse()->setHeader('Access-Control-Allow-Methods', 'OPTIONS, GET, POST, PUT, DELETE');
        $this->getResponse()->setHeader('Access-Control-Allow-Headers', 'Content-Type, x-requested-with');
        $this->getResponse()->setHeader('Access-Control-Allow-Credentials', 'true');
        $this->getResponse()->setBody(null);
        $this->_helper->viewRenderer->setNoRender(true);
    }

预检请求 header 看起来不错，我得到 200 OK:

请求 header :

Host: domain1111.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: https://domain2222.com
Access-Control-Request-Method: GET (this is seen as OPTIONS in network tab)
Access-Control-Request-Headers: x-requested-with
Connection: keep-alive
Cache-Control: max-age=0

和响应头:

Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: OPTIONS, GET, POST, PUT, DELETE
Access-Control-Allow-Origin: https://domain2222.com
Cache-Control: max-age=0, s-maxage=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html
Date: Thu, 11 Jun 2015 08:40:42 GMT
Etag: "d41d8cd98f00b204e9800998ecf8427e"
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=5, max=100
Pragma: no-cache
Server: Apache
Vary: X-CDN
X-Frame-Options: SAMEORIGIN
X-Ua-Compatible: IE=edge,chrome=1

我得到的是空响应，这很好，并且一个新请求被发送到相同的地址，但是方法是 GET 而不是 OPTIONS，它看起来像这样:

请求 header :

Host: domain1111.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Referer: https://domain2222.com/some/request
Origin: https://domain1111.com
Cookie: s1=533C36A9095C003A; 
BGUID=some complicated guid here
Connection: keep-alive
Cache-Control: max-age=0

和响应:

Access-Control-Allow-Origin: https://domain2222.com
Cache-Control: max-age=0, s-maxage=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Content-Length: 3278
Content-Type: application/json
Date: Thu, 11 Jun 2015 08:40:43 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=5, max=99
Pragma: no-cache
Server: Apache
Vary: X-CDN
X-Frame-Options: SAMEORIGIN

问题是在发送真实请求后，我进入了 Firefox:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://domain1111.com/some/request. (Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials')

在 Chrome 中也类似:

XMLHttpRequest cannot load https://domain1111.com/some/request. Credentials flag is 'true', but the 'Access-Control-Allow-Credentials' header is ''. It must be 'true' to allow credentials.

这些错误发生在第二个 CORS 请求完成时。所以在发送第一个预检请求后，它返回 200 OK 和一个空响应，这很好；发送第二个请求后，我收到上面列出的错误，没有返回任何数据。

此外，Firefox 中的“响应”选项卡向我显示此消息:

SyntaxError: JSON.parse: unexpected end of data at line 1 column 1 on the JSON data

我不确定在第二次请求期间是否也发送了属性“withCredential”，也许服务器没有返回:

'Access-Control-Allow-Credentials', 'true'

为什么它只发生在 OPTIONS 请求中？

无论请求方法是什么，我都应该从服务器返回这些 header 吗？或者 ajaxSetup 有问题？也许它不应该在第二个 CORS 请求中发送“withCredentials: true”？

更新:

The problem has been fixed by adding Access-Control-Allow-Credentials: true, to all responses returned by the server (PUT, GET, POST, DELETE, OPTIONS)

Answer 1

根据W3C CORS docs , §7.1.5第 3 步，预检和实际请求都必须执行“资源共享检查”。来自 §7.2定义该检查的位置:

1. If the response includes zero or more than one Access-Control-Allow-Origin header values, return fail and terminate this algorithm.

[..]

4. If the omit credentials flag is unset and the response includes zero or more than one Access-Control-Allow-Credentials header values, return fail and terminate this algorithm.

换句话说，预检和实际响应都必须包含 Access-Control-Allow-Origin header ，如果使用它，还包含 Access-Control-Allow-Credentials header 。