javascript - 无法访问 Set-cookie 响应 header 和/或 cookie 请求 header

Question

我正在尝试使用 REST API 登录平台。关于 REST API 身份验证的平台文档表示，在发布凭证后进行身份验证时，该帖子将返回 session cookie 以发送回所有后续经过身份验证的请求。问题是我正在使用跨域，这不允许我访问 Set-cookie header 或 cookie header 。我尝试了很多在论坛上看到的东西。

这是实际的服务器配置:

Access-Control-Allow-Origin:*;Access-Control-Allow-Methods:GET, POST, OPTIONS;Access-Control-Expose-Headers:Set-Cookie;Access-Control-Allow-Headers:Set-Cookie;HttpOnly:false;

这是我使用此配置在发布后得到的响应 header :

Access-Control-Allow-Headers:Set-Cookie
Access-Control-Allow-Methods:GET, POST, OPTIONS
Access-Control-Allow-Origin:http://127.0.0.1:4482
Access-Control-Expose-Headers:Set-Cookie
Cache-Control:no-cache, no-store, private
Connection:keep-alive
Content-Length:10
Content-Type:text/plain; charset=utf-8
Date:Wed, 23 Mar 2016 08:51:02 GMT
HttpOnly:false
Server:Wisp/1.0.67.13
Set-Cookie:fanws=071b2016-2718-f680-7149-000d3ab17336-cea3f199fc0dd453;Path=/
X-Frame-Options:SAMEORIGIN

Set-cookie header 中的值不会在浏览器中自动设置，并且似乎无法使用 JavaScript 获取。当我输入:

console.log(headers.getAllResponseHeaders());

我什至在控制台中没有看到 Set-Cookie。我得到的只是这样:

Content-Type: text/plain; charset=utf-8
Cache-Control: no-cache, no-store, private

我也使用了这个配置服务器端:

Access-Control-Allow-Origin:http://127.0.0.1:4482;
Access-Control-Allow-Methods:GET, POST, OPTIONS;
Access-Control-Expose-Headers:Set-Cookie;
Access-Control-Allow-Headers:Set-Cookie;
HttpOnly:false;
Access-Control-Allow-Credentials:true;

客户端唯一发生的变化是 Set-Cookie 从响应 header 中消失，并且具有相同值的 Cookie header 出现在请求 header 中:

Accept:application/json, text/plain, */*
Accept-Encoding:gzip, deflate
Accept-Language:fr-FR,fr;q=0.8,en-US;q=0.6,en;q=0.4
Connection:keep-alive
Content-Length:103
Content-Type:application/x-www-form-urlencoded; charset=UTF-8
Cookie:fanws=071ad3d7-a5ad-4cc0-7ff4-000d3ab17336-d81da7968d36156c
Host:********
Origin:http://127.0.0.1:4482
Referer:http://127.0.0.1:4482/Skyspark.html
User-Agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36

我仍然遇到同样的问题，即我无法访问服务器发送的cookie。

Answer 1

XHR API forbids direct access to cookie data .

Return all response headers, excluding headers that are a case-insensitive match for Set-Cookie or Set-Cookie2, as a single string, with each header line separated by a U+000D CR U+000A LF pair, excluding the status line, and with each header name and header value separated by a U+003A COLON U+0020 SPACE pair.

您需要使用其他方法传递数据，或者只是set withCredentials并让浏览器在内部处理cookie。