个人中心
gpt4 book ai didi

ajax - Preflight request ok，然后，auth之后，response does not contain allow cors header

转载 作者：行者123 更新时间：2023-11-30 23:46:22 25 4
gpt4 key购买 nike

在 IIS 8.5 上部署的 Asp MVC 5 应用程序。需要启用来自多个客户端的 ajax 请求。

服务器端我有在WebApiConfig.cs

config.EnableCors();

在 Controller 中:

[EnableCors(origins: "http://localhost:59901", headers: "*", methods: "*", SupportsCredentials = true)]
public class ItemController : Controller

客户端

$("#getItem").on("click", function (e) {
    var myurl = "http://servername/item/details/1"

    $.ajax({
        url: myurl,
        type: "GET",
        dataType: "JSON",
        xhrFields: {
            withCredentials: true
        },
        contentType: "application/json; charset=utf-8",
        error: function (jqXHR, textStatus, errorThrown) {
            $('#result').text(jqXHR.responseText || textStatus);
        },
        success: function (result) {
            $('#result').text(result);
        }
    });
});

从 VisualStudio Origin 运行的客户端是 http://localhost:59901 .

运行 ajax 请求，我在 fiddler 中得到以下内容:

<强>1。飞行前请求/响应

OPTIONS http://vrtsrv01.webdev.local/item/details/1 HTTP/1.1
Host: vrtsrv01.webdev.local
Connection: keep-alive
Access-Control-Request-Method: GET
Origin: http://localhost:59901
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Access-Control-Request-Headers: content-type
Accept: */*
Referer: http://localhost:59901/Home/Index
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,it;q=0.6,it-IT;q=0.4

HTTP/1.1 200 OK
Server: Microsoft-IIS/8.5
Access-Control-Allow-Origin: http://localhost:59901
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, MaxDataServiceVersion
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Credentials: true
X-Powered-By: ASP.NET
Date: Sat, 13 May 2017 15:34:54 GMT
Content-Length: 0

<强>2。没有凭据的 GET 请求/401 错误响应

GET http://vrtsrv01.webdev.local/item/details/1 HTTP/1.1
Host: vrtsrv01.webdev.local
Connection: keep-alive
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://localhost:59901
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Content-Type: application/json; charset=utf-8
Referer: http://localhost:59901/Home/Index
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,it;q=0.6,it-IT;q=0.4

HTTP/1.1 401 Unauthorized
Cache-Control: private
Content-Type: text/html
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
Date: Sat, 13 May 2017 15:34:54 GMT
Content-Length: 1352
Proxy-Support: Session-Based-Authentication

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>401 - Autorizzazione negata: accesso negato a causa di credenziali non valide.</title>
....
</head>
<body>
<div id="header"><h1>Errore del server</h1></div>
....
</body>
</html>

<强>3。带有 NTLM token 的 GET 请求，用于不带 Allow CORS header 的身份验证/响应

GET http://vrtsrv01.webdev.local/item/details/1 HTTP/1.1
Host: vrtsrv01.webdev.local
Connection: keep-alive
Authorization: Negotiate <...NTLM TOKEN HERE ...>
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://localhost:59901
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Content-Type: application/json; charset=utf-8
Referer: http://localhost:59901/Home/Index
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,it;q=0.6,it-IT;q=0.4


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json; charset=utf-8
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
Persistent-Auth: true
X-Powered-By: ASP.NET
Date: Sat, 13 May 2017 15:34:58 GMT
Content-Length: 8557

{"id":1, .....}

问题

为什么在为 CORS 启用 MVC 应用程序并看到对预检请求的正确响应后，NTLM 身份验证后获得的响应不包含预期的 Access-Control-Allow-Origin header ？

最佳答案

我不确定它是否对您有帮助，但它可能对希望同时启用 NTLM 和 CORS 的其他人有所帮助。

启用 CORS

public static class WebApiConfig
{
    public static void Register(HttpConfiguration config)
    {
        var corsAttr = new EnableCorsAttribute("*", "*", "*") { SupportsCredentials = true };
        //SupportsCredentials = true means that we will add Access-Control-Allow-Credentials to the response.
        config.EnableCors(corsAttr);
    }
}

SupportsCredentials = true 表示我们将在响应中添加 Access-Control-Allow-Credentials。

其他解决方案，

global.asax.cs - 正确回复 header ，允许来自另一个域的调用者接收数据

protected void Application_AuthenticateRequest(object sender, EventArgs e)
{
    if (Context.Request.HttpMethod == "OPTIONS")
    {
        Context.Response.AddHeader("Access-Control-Allow-Origin", Context.Request.Headers["Origin"]);
        Context.Response.AddHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept,MaxDataServiceVersion");
        Context.Response.AddHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
        Context.Response.AddHeader("Access-Control-Allow-Credentials", "true");
        Context.Response.End();
    }
}

关于ajax - Preflight request ok，然后，auth之后，response does not contain allow cors header，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/43955532/

25 4 0
文章推荐： rest - 具有 RESTful 的复杂域 URL 结构
文章推荐： xslt - 寻找(伪)XSLT 预处理器/模板器以使其不那么冗长
文章推荐： emacs - 为什么我的 term-mode-hook 没有选择行模式？
文章推荐： MySQL 选择不同的值并选择更多
行者123
个人简介

我是一名优秀的程序员,十分优秀！

滴滴打车优惠券免费领取
滴滴打车优惠券
全站热门文章
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com