php - 公共(public)文件的 Laravel CORS 问题

Question

我正在尝试从 Angular 访问日志文件 URL，但它显示以下错误:

Access to XMLHttpRequest at 'https://myurl.com/storage/rmlogs/MyFileNameDetail.log' from origin 'http://localhost:4200' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

所有 API 请求都运行良好，错误仅针对文件请求。我将我的文件存储在 rmlogs 目录中，该目录位于 storage/app/public/rmlogs 中，它链接到 public 文件夹。

API 代码库是 Laravel，文件存储在 storage 目录中。我可以通过浏览器和 Postman 访问该文件。由于该 URL 是公开可用的，因此它不需要我为其他 API 请求传递的身份验证 token 。

我的 cors.php 配置文件如下:

<?php

return [

    /*
    |--------------------------------------------------------------------------
    | Cross-Origin Resource Sharing (CORS) Configuration
    |--------------------------------------------------------------------------
    |
    | Here you may configure your settings for cross-origin resource sharing
    | or "CORS". This determines what cross-origin operations may execute
    | in web browsers. You are free to adjust these settings as needed.
    |
    | To learn more: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
    |
    */

    'paths' => ['api/*'],

    'allowed_methods' => ['*'],

    'allowed_origins' => ['*'],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['*'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => true,

];

并且有一个 Cors.php 中间件，如下所示:

<?php

namespace App\Http\Middleware;

use Closure;

class Cors
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
    return $next($request)
        ->header('Access-Control-Allow-Origin', '*')
        ->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
    }
}

Answer 1

通过this blog :

there are packages available that allow for adding CORS headers to responses sent from a Laravel API. They do so by applying middleware to all of the API’s routes. However, such middleware is not applied to the public directory, and that is often the storage location for resources such as user avatar images. Therefore, when those resources are returned to the browser, they do not have the necessary CORS headers applied.

因此您需要使用其他方法应用 header 。使用 HTTP 服务器的配置文件可能最容易完成此操作。

您已标记此 apache所以你可以设置:

Header set Access-Control-Allow-Origin "*"

在你的配置文件中。

例如:

<Location "/storage/rmlogs/">
    Header set Access-Control-Allow-Origin "*"
</Location>

您还可以将 Header 指令放在 a .htaccess file 中，但不推荐这样做:

You should avoid using .htaccess files completely if you have access to httpd main server config file. Using .htaccess files slows down your Apache http server. Any directive that you can include in a .htaccess file is better set in a Directory block, as it will have the same effect with better performance.

如果您使用的是共享主机，您可能别无选择。