loopbackjs - 尽管通配符环回 4 CORS 不起作用

Question

documentation建议默认情况下启用 CORS。但是使用默认的 CORS 配置，我仍然遇到 CORS 问题。检查响应 header ，没有附加 CORS header 。

Access to XMLHttpRequest at 'http://localhost:8081/sessions' from origin 'http://local.example.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

// src/index.ts

if (require.main === module) {
  // Run the application
  const config: ApplicationConfig = {
    rest: {
      port: +(process.env.PORT ?? 8081),
      host: process.env.HOST,
      // The `gracePeriodForClose` provides a graceful close for http/https
      // servers with keep-alive clients. The default value is `Infinity`
      // (don't force-close). If you want to immediately destroy all sockets
      // upon stop, set its value to `0`.
      // See https://www.npmjs.com/package/stoppable
      gracePeriodForClose: 5000, // 5 seconds
      openApiSpec: {
        // useful when used with OpenAPI-to-GraphQL to locate your application
        setServersFromRequest: true,
      },
      cors: {
        origin: '*',
        methods: 'GET,HEAD,PUT,PATCH,POST,DELETE',
        preflightContinue: false,
        optionsSuccessStatus: 204,
        credentials: true,
      },
    },
  }
  main(config).catch((err) => {
    console.error('Cannot start the application.', err)
    process.exit(1)
  })
}

Answer 1

我猜这是新版本的 LB4 带来的问题。这是您可以放入 MySequence 的解决方法(确保在 application.ts 中添加序列):

    async handle(context: RequestContext) {
        try {
            const { request, response } = context;
            // add this
            await this.invokeMiddleware(context, this.options);
            response.header('Access-Control-Allow-Origin', '*');
            response.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
            if (request.method == 'OPTIONS') {
                response.status(200)
                this.send(response, 'ok');
            } else {
                // end add this
                const route = this.findRoute(request);
                await this.authenticateRequest(request);
                const args = await this.parseParams(request, route);
                const result = await this.invoke(route, args);
                this.send(response, result);
            }
        } catch (err) {
            if (
                err.code === AUTHENTICATION_STRATEGY_NOT_FOUND ||
                err.code === USER_PROFILE_NOT_FOUND
            ) {
                Object.assign(err, { statusCode: 401 /* Unauthorized */ });
            }
            this.reject(context, err);
        }

请不要介意所有其他内容，例如身份验证/中间件，这就是所有内容 if (request.method == 'OPTIONS') {}