Javascript - 对预检请求的响应未通过访问控制检查

Question

我正在尝试为 strip 创建一个结帐 session ，就像文档所说的那样，但我收到此错误:

Access to fetch at 'https://subdomain' from origin 'https://main-domain' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

我应该在哪里以及如何添加指定的标题？
这是点击结帐按钮时发送的请求:

<script type="text/javascript">
   var stripe = Stripe('api key');
   var checkoutButton = document.getElementById('checkout-button');
   
   checkoutButton.addEventListener('click', function() {
     fetch('https://subdomain/create-session', {
       method: 'POST',
       headers: new Headers({
       'Authorization': 'Basic',
       'Access-Control-Allow-Origin': '*'
       })
     })
     .then(function(response) {
       return response.json();
     })
     .then(function(session) {
       return stripe.redirectToCheckout({ sessionId: session.id });
     })
     .then(function(result) {
       if (result.error) {
         alert(result.error.message);
       }
     })
     .catch(function(error) {
       console.error('Error:', error);
     });
   });
</script>

这是我的快速路线:

app.post("/create-checkout-session", async (req, res) => {
    const session = await stripe.checkout.sessions.create({
        payment_method_types: ['card'],
        line_items: [
            { price: 'stripe product id', quantity: 1 },
            { price: 'stripe product id', quantity: 1 }
        ],
        mode: 'payment',
        success_url: 'https://site/success.html',
        cancel_url: 'https://site/cancel.html',
    });
    res.json({ id: session.id });
});

Answer 1

header 应包含在服务器响应中，而不是客户端请求中。通过 express ，您可以使用 CORS middleware为了这。