Zignorowanie znaku wieloznacznego w sterowniku Access-Control-Allow-Headers?

Question

Mam problemy z uzyskaniem żądania cors o domenie krzyżowej do poprawnego działania za pomocą chrome.

Żądanie Nagłówki:

Accept:*/* 
Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3 
Accept-Encoding:gzip,deflate,sdch 
Accept-Language:en-US,en;q=0.8 
Access-Control-Request-Headers:origin, content-type 
Access-Control-Request-Method:POST 
Connection:keep-alive 
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1229.94 Safari/537.4 

nagłówki odpowiedzi:

Access-Control-Allow-Headers:* 
Access-Control-Allow-Origin:* 
Allow:GET, POST, OPTIONS 
Content-Length:0 
Date:Tue, 30 Oct 2012 20:04:28 GMT 
Server:BaseHTTP/0.3 Python/2.7.3 

Błąd:

XMLHttpRequest cannot load domain. Request header field Content-Type is not allowed by Access-Control-Allow-Headers. 

I kod python obsługujących żądania opcji wynosi:

self.send_response(200) 
self.send_header('Allow', 'GET, POST, OPTIONS') 
self.send_header('Access-Control-Allow-Origin', '*') 
self.send_header('Access-Control-Allow-Headers', '*') 
self.send_header('Content-Length', '0') 
self.end_headers() 

Wygląda na to, że znak wieloznaczny Access-Control-Allow-Origin jest ignorowany?

Answer 1

Obsługa symboli wieloznacznych w nagłówku Access-Control-Allow-Headers była added to the living standard tylko w maju 2016 r., Więc może nie być obsługiwana we wszystkich przeglądarkach. W przeglądarce, które nie realizują to jeszcze musi być dokładne dopasowanie: https://www.w3.org/TR/2014/REC-cors-20140116/#access-control-allow-headers-response-header

Jeśli oczekujesz dużej liczby nagłówków, można odczytać wartości nagłówka Access-Control-Request-Headers i echo tę wartość z powrotem w nagłówku Access-Control-Allow-Headers .

Answer 2

Znalazłem, że Access-Control-Allow-Headers: * powinien być ustawiony TYLKO dla żądania "OPCJE". Jeśli go zwrócić na żądanie POST następnie przeglądarka anulować żądanie (przynajmniej dla Chrome)

Poniższy kod PHP działa na mnie

// Allow CORS 
if (isset($_SERVER['HTTP_ORIGIN'])) { 
    header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}"); 
    header('Access-Control-Allow-Credentials: true');  
    header("Access-Control-Allow-Methods: GET, POST, OPTIONS"); 
} 
// Access-Control headers are received during OPTIONS requests 
if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') { 
    header("Access-Control-Allow-Headers: *"); 
} 

Znalazłem podobne pytania z pewnym mylących odpowiedzi:

• Wątek serwera mówi, że jest to 2 lata błędu w chrome: Access-Control-Allow-Headers nie pasuje do localhost. To źle: mogę używać CORS na moim lokalnym serwerze z Post normalnie
• Kontrolki dostępu do kontrolek zezwalają na używanie symboli wieloznacznych. Jest także błędem, dzika karta działa dla mnie (testowałem tylko z Chrome)

To zajmuje mi pół dnia, aby dowiedzieć się problem.

Szczęśliwy kodowanie

Answer 3

Cytat z monsur,

The Access-Control-Allow-Headers header does not allow wildcards. It must be an exact match: http://www.w3.org/TR/cors/#access-control-allow-headers-response-header .

Więc tu jest moje rozwiązanie php.

if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') { 
    $headers=getallheaders(); 
    @$ACRH=$headers["Access-Control-Request-Headers"]; 
    header("Access-Control-Allow-Headers: $ACRH"); 
} 

Answer 4

Those CORS nagłówki nie obsługują * jako wartość, tylko w ten sposób ma na celu zastąpienie * z tym:

Accept, Accept-CH, Accept-Charset, Accept-Datetime, Accept-Encoding, Accept-Ext, Accept-Features, Accept-Language, Accept-Params, Accept-Ranges, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin, Access-Control-Expose-Headers, Access-Control-Max-Age, Access-Control-Request-Headers, Access-Control-Request-Method, Age, Allow, Alternates, Authentication-Info, Authorization, C-Ext, C-Man, C-Opt, C-PEP, C-PEP-Info, CONNECT, Cache-Control, Compliance, Connection, Content-Base, Content-Disposition, Content-Encoding, Content-ID, Content-Language, Content-Length, Content-Location, Content-MD5, Content-Range, Content-Script-Type, Content-Security-Policy, Content-Style-Type, Content-Transfer-Encoding, Content-Type, Content-Version, Cookie, Cost, DAV, DELETE, DNT, DPR, Date, Default-Style, Delta-Base, Depth, Derived-From, Destination, Differential-ID, Digest, ETag, Expect, Expires, Ext, From, GET, GetProfile, HEAD, HTTP-date, Host, IM, If, If-Match, If-Modified-Since, If-None-Match, If-Range, If-Unmodified-Since, Keep-Alive, Label, Last-Event-ID, Last-Modified, Link, Location, Lock-Token, MIME-Version, Man, Max-Forwards, Media-Range, Message-ID, Meter, Negotiate, Non-Compliance, OPTION, OPTIONS, OWS, Opt, Optional, Ordering-Type, Origin, Overwrite, P3P, PEP, PICS-Label, POST, PUT, Pep-Info, Permanent, Position, Pragma, ProfileObject, Protocol, Protocol-Query, Protocol-Request, Proxy-Authenticate, Proxy-Authentication-Info, Proxy-Authorization, Proxy-Features, Proxy-Instruction, Public, RWS, Range, Referer, Refresh, Resolution-Hint, Resolver-Location, Retry-After, Safe, Sec-Websocket-Extensions, Sec-Websocket-Key, Sec-Websocket-Origin, Sec-Websocket-Protocol, Sec-Websocket-Version, Security-Scheme, Server, Set-Cookie, Set-Cookie2, SetProfile, SoapAction, Status, Status-URI, Strict-Transport-Security, SubOK, Subst, Surrogate-Capability, Surrogate-Control, TCN, TE, TRACE, Timeout, Title, Trailer, Transfer-Encoding, UA-Color, UA-Media, UA-Pixels, UA-Resolution, UA-Windowpixels, URI, Upgrade, User-Agent, Variant-Vary, Vary, Version, Via, Viewport-Width, WWW-Authenticate, Want-Digest, Warning, Width, X-Content-Duration, X-Content-Security-Policy, X-Content-Type-Options, X-CustomHeader, X-DNSPrefetch-Control, X-Forwarded-For, X-Forwarded-Port, X-Forwarded-Proto, X-Frame-Options, X-Modified, X-OTHER, X-PING, X-PINGOTHER, X-Powered-By, X-Requested-With

---

.htaccess Przykład (CORS dołączonych)

<IfModule mod_headers.c> 
    Header unset Connection 
    Header unset Time-Zone 
    Header unset Keep-Alive 
    Header unset Access-Control-Allow-Origin 
    Header unset Access-Control-Allow-Headers 
    Header unset Access-Control-Expose-Headers 
    Header unset Access-Control-Allow-Methods 
    Header unset Access-Control-Allow-Credentials 

    Header set Connection       keep-alive 
    Header set Time-Zone       "Asia/Jerusalem" 
    Header set Keep-Alive       timeout=100,max=500 
    Header set Access-Control-Allow-Origin  "*" 
    Header set Access-Control-Allow-Headers  "Accept, Accept-CH, Accept-Charset, Accept-Datetime, Accept-Encoding, Accept-Ext, Accept-Features, Accept-Language, Accept-Params, Accept-Ranges, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin, Access-Control-Expose-Headers, Access-Control-Max-Age, Access-Control-Request-Headers, Access-Control-Request-Method, Age, Allow, Alternates, Authentication-Info, Authorization, C-Ext, C-Man, C-Opt, C-PEP, C-PEP-Info, CONNECT, Cache-Control, Compliance, Connection, Content-Base, Content-Disposition, Content-Encoding, Content-ID, Content-Language, Content-Length, Content-Location, Content-MD5, Content-Range, Content-Script-Type, Content-Security-Policy, Content-Style-Type, Content-Transfer-Encoding, Content-Type, Content-Version, Cookie, Cost, DAV, DELETE, DNT, DPR, Date, Default-Style, Delta-Base, Depth, Derived-From, Destination, Differential-ID, Digest, ETag, Expect, Expires, Ext, From, GET, GetProfile, HEAD, HTTP-date, Host, IM, If, If-Match, If-Modified-Since, If-None-Match, If-Range, If-Unmodified-Since, Keep-Alive, Label, Last-Event-ID, Last-Modified, Link, Location, Lock-Token, MIME-Version, Man, Max-Forwards, Media-Range, Message-ID, Meter, Negotiate, Non-Compliance, OPTION, OPTIONS, OWS, Opt, Optional, Ordering-Type, Origin, Overwrite, P3P, PEP, PICS-Label, POST, PUT, Pep-Info, Permanent, Position, Pragma, ProfileObject, Protocol, Protocol-Query, Protocol-Request, Proxy-Authenticate, Proxy-Authentication-Info, Proxy-Authorization, Proxy-Features, Proxy-Instruction, Public, RWS, Range, Referer, Refresh, Resolution-Hint, Resolver-Location, Retry-After, Safe, Sec-Websocket-Extensions, Sec-Websocket-Key, Sec-Websocket-Origin, Sec-Websocket-Protocol, Sec-Websocket-Version, Security-Scheme, Server, Set-Cookie, Set-Cookie2, SetProfile, SoapAction, Status, Status-URI, Strict-Transport-Security, SubOK, Subst, Surrogate-Capability, Surrogate-Control, TCN, TE, TRACE, Timeout, Title, Trailer, Transfer-Encoding, UA-Color, UA-Media, UA-Pixels, UA-Resolution, UA-Windowpixels, URI, Upgrade, User-Agent, Variant-Vary, Vary, Version, Via, Viewport-Width, WWW-Authenticate, Want-Digest, Warning, Width, X-Content-Duration, X-Content-Security-Policy, X-Content-Type-Options, X-CustomHeader, X-DNSPrefetch-Control, X-Forwarded-For, X-Forwarded-Port, X-Forwarded-Proto, X-Frame-Options, X-Modified, X-OTHER, X-PING, X-PINGOTHER, X-Powered-By, X-Requested-With" 
    Header set Access-Control-Expose-Headers  "Accept, Accept-CH, Accept-Charset, Accept-Datetime, Accept-Encoding, Accept-Ext, Accept-Features, Accept-Language, Accept-Params, Accept-Ranges, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin, Access-Control-Expose-Headers, Access-Control-Max-Age, Access-Control-Request-Headers, Access-Control-Request-Method, Age, Allow, Alternates, Authentication-Info, Authorization, C-Ext, C-Man, C-Opt, C-PEP, C-PEP-Info, CONNECT, Cache-Control, Compliance, Connection, Content-Base, Content-Disposition, Content-Encoding, Content-ID, Content-Language, Content-Length, Content-Location, Content-MD5, Content-Range, Content-Script-Type, Content-Security-Policy, Content-Style-Type, Content-Transfer-Encoding, Content-Type, Content-Version, Cookie, Cost, DAV, DELETE, DNT, DPR, Date, Default-Style, Delta-Base, Depth, Derived-From, Destination, Differential-ID, Digest, ETag, Expect, Expires, Ext, From, GET, GetProfile, HEAD, HTTP-date, Host, IM, If, If-Match, If-Modified-Since, If-None-Match, If-Range, If-Unmodified-Since, Keep-Alive, Label, Last-Event-ID, Last-Modified, Link, Location, Lock-Token, MIME-Version, Man, Max-Forwards, Media-Range, Message-ID, Meter, Negotiate, Non-Compliance, OPTION, OPTIONS, OWS, Opt, Optional, Ordering-Type, Origin, Overwrite, P3P, PEP, PICS-Label, POST, PUT, Pep-Info, Permanent, Position, Pragma, ProfileObject, Protocol, Protocol-Query, Protocol-Request, Proxy-Authenticate, Proxy-Authentication-Info, Proxy-Authorization, Proxy-Features, Proxy-Instruction, Public, RWS, Range, Referer, Refresh, Resolution-Hint, Resolver-Location, Retry-After, Safe, Sec-Websocket-Extensions, Sec-Websocket-Key, Sec-Websocket-Origin, Sec-Websocket-Protocol, Sec-Websocket-Version, Security-Scheme, Server, Set-Cookie, Set-Cookie2, SetProfile, SoapAction, Status, Status-URI, Strict-Transport-Security, SubOK, Subst, Surrogate-Capability, Surrogate-Control, TCN, TE, TRACE, Timeout, Title, Trailer, Transfer-Encoding, UA-Color, UA-Media, UA-Pixels, UA-Resolution, UA-Windowpixels, URI, Upgrade, User-Agent, Variant-Vary, Vary, Version, Via, Viewport-Width, WWW-Authenticate, Want-Digest, Warning, Width, X-Content-Duration, X-Content-Security-Policy, X-Content-Type-Options, X-CustomHeader, X-DNSPrefetch-Control, X-Forwarded-For, X-Forwarded-Port, X-Forwarded-Proto, X-Frame-Options, X-Modified, X-OTHER, X-PING, X-PINGOTHER, X-Powered-By, X-Requested-With" 
    Header set Access-Control-Allow-Methods  "CONNECT, DEBUG, DELETE, DONE, GET, HEAD, HTTP, HTTP/0.9, HTTP/1.0, HTTP/1.1, HTTP/2, OPTIONS, ORIGIN, ORIGINS, PATCH, POST, PUT, QUIC, REST, SESSION, SHOULD, SPDY, TRACE, TRACK" 
    Header set Access-Control-Allow-Credentials "true" 

    Header set DNT "0" 
    Header set Accept-Ranges "bytes" 
    Header set Vary "Accept-Encoding" 
    Header set X-UA-Compatible "IE=edge,chrome=1" 
    Header set X-Frame-Options "SAMEORIGIN" 
    Header set X-Content-Type-Options "nosniff" 
    Header set X-Xss-Protection "1; mode=block" 
</IfModule> 

---

F.A.Q:

• Dlaczego Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Allow-Methods wartości są bardzo długo?

  Ci nie obsługuje składni *, więc zebrałem najczęstsze (i egzotyczne) nagłówki z internetu, w różnych formatach #1#2#3 _{(i będę aktualizował listę od czasu do czasu)}

• Dlaczego używasz składni Header unset ______?

  Serwery GoDaddy (na której moja witryna jest hostowana ...) mają dziwny błąd, jeśli nagłówki są już ustawione, poprzednia wartość zostanie dołączona do istniejącego .. (zamiast zastąpienia) w ten sposób " clean”istniejące wartości _{(naprawdę tylko aa szybkie & & brudny solution)}

• Czy to bezpieczne dla mnie do używania 'jak jest'?

  Cóż .. głównie odpowiedź byłaby TAK od .htaccess ogranicza nagłówków do skryptów (PHP, HTML, ...) i zasobów (.JPG, js, .CSS) serwowane z następujących "folder" - lokalizacja. Opcjonalnie możesz chcieć usunąć linie Access-Control-Allow-Methods. _{także Connection, Time-Zone, Keep-Alive i DNT, Accept-Ranges, Vary, X-UA-Compatible, X-Frame-Options, X-Content-Type-Options i X-Xss-Protection to tylko sugestia używam dla mojej Online-Service .. krępuj się usunąć te zbyt ...}

_{wzięte z mojego comment above}