Cors carattere Access-Control-Allow-Headers ignorato?

Question

Non riesco a ottenere una richiesta cors di dominio incrociato per funzionare correttamente utilizzando chrome.

intestazioni di richiesta:

Accept:*/* 
Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3 
Accept-Encoding:gzip,deflate,sdch 
Accept-Language:en-US,en;q=0.8 
Access-Control-Request-Headers:origin, content-type 
Access-Control-Request-Method:POST 
Connection:keep-alive 
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1229.94 Safari/537.4 

intestazioni di risposta:

Access-Control-Allow-Headers:* 
Access-Control-Allow-Origin:* 
Allow:GET, POST, OPTIONS 
Content-Length:0 
Date:Tue, 30 Oct 2012 20:04:28 GMT 
Server:BaseHTTP/0.3 Python/2.7.3 

Errore:

XMLHttpRequest cannot load domain. Request header field Content-Type is not allowed by Access-Control-Allow-Headers. 

E il codice python servire la richiesta di opzioni è:

self.send_response(200) 
self.send_header('Allow', 'GET, POST, OPTIONS') 
self.send_header('Access-Control-Allow-Origin', '*') 
self.send_header('Access-Control-Allow-Headers', '*') 
self.send_header('Content-Length', '0') 
self.end_headers() 

Sembra che il carattere jolly Access-Control-Allow-Origin venga ignorato?

Answer 1

Il supporto per caratteri jolly nell'intestazione Access-Control-Allow-Headers era added to the living standard solo a maggio 2016, quindi potrebbe non essere supportato da tutti i browser. Sul browser, che non attuano ancora presente, deve essere una corrispondenza esatta: https://www.w3.org/TR/2014/REC-cors-20140116/#access-control-allow-headers-response-header

Se vi aspettate un gran numero di intestazioni, si può leggere nel valore dell'intestazione Access-Control-Request-Headers e l'eco che il valore indietro nell'intestazione Access-Control-Allow-Headers .

Answer 2

Ho trovato che Access-Control-Allow-Headers: * deve essere impostato SOLO per la richiesta "OPTIONS". Se restituirli per richiesta POST, allora il browser annullare la richiesta (almeno per Chrome)

Il seguente codice PHP funziona per me

// Allow CORS 
if (isset($_SERVER['HTTP_ORIGIN'])) { 
    header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}"); 
    header('Access-Control-Allow-Credentials: true');  
    header("Access-Control-Allow-Methods: GET, POST, OPTIONS"); 
} 
// Access-Control headers are received during OPTIONS requests 
if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') { 
    header("Access-Control-Allow-Headers: *"); 
} 

ho trovato domande simili con qualche risposta fuorviante:

• Il thread del server dice che si tratta di bug di 2 anni di chrome: Access-Control-Allow-Headers non corrisponde a localhost. È sbagliato: posso utilizzare CORS sul mio server locale con Posta normalmente
• Access-Control-Allow-Headers accetta caratteri jolly. È anche sbagliato, funziona jolly per me (ho provato solo con Chrome)

Questo mi prende mezza giornata per capire il problema. codifica

Felice

Answer 3

Citato da Monsur,

The Access-Control-Allow-Headers header does not allow wildcards. It must be an exact match: http://www.w3.org/TR/cors/#access-control-allow-headers-response-header .

Quindi ecco la mia soluzione PHP.

if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') { 
    $headers=getallheaders(); 
    @$ACRH=$headers["Access-Control-Request-Headers"]; 
    header("Access-Control-Allow-Headers: $ACRH"); 
} 

Answer 4

Quei CORS intestazioni non supportano * come valore, l'unico modo è quello di sostituire * con questo:

Accept, Accept-CH, Accept-Charset, Accept-Datetime, Accept-Encoding, Accept-Ext, Accept-Features, Accept-Language, Accept-Params, Accept-Ranges, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin, Access-Control-Expose-Headers, Access-Control-Max-Age, Access-Control-Request-Headers, Access-Control-Request-Method, Age, Allow, Alternates, Authentication-Info, Authorization, C-Ext, C-Man, C-Opt, C-PEP, C-PEP-Info, CONNECT, Cache-Control, Compliance, Connection, Content-Base, Content-Disposition, Content-Encoding, Content-ID, Content-Language, Content-Length, Content-Location, Content-MD5, Content-Range, Content-Script-Type, Content-Security-Policy, Content-Style-Type, Content-Transfer-Encoding, Content-Type, Content-Version, Cookie, Cost, DAV, DELETE, DNT, DPR, Date, Default-Style, Delta-Base, Depth, Derived-From, Destination, Differential-ID, Digest, ETag, Expect, Expires, Ext, From, GET, GetProfile, HEAD, HTTP-date, Host, IM, If, If-Match, If-Modified-Since, If-None-Match, If-Range, If-Unmodified-Since, Keep-Alive, Label, Last-Event-ID, Last-Modified, Link, Location, Lock-Token, MIME-Version, Man, Max-Forwards, Media-Range, Message-ID, Meter, Negotiate, Non-Compliance, OPTION, OPTIONS, OWS, Opt, Optional, Ordering-Type, Origin, Overwrite, P3P, PEP, PICS-Label, POST, PUT, Pep-Info, Permanent, Position, Pragma, ProfileObject, Protocol, Protocol-Query, Protocol-Request, Proxy-Authenticate, Proxy-Authentication-Info, Proxy-Authorization, Proxy-Features, Proxy-Instruction, Public, RWS, Range, Referer, Refresh, Resolution-Hint, Resolver-Location, Retry-After, Safe, Sec-Websocket-Extensions, Sec-Websocket-Key, Sec-Websocket-Origin, Sec-Websocket-Protocol, Sec-Websocket-Version, Security-Scheme, Server, Set-Cookie, Set-Cookie2, SetProfile, SoapAction, Status, Status-URI, Strict-Transport-Security, SubOK, Subst, Surrogate-Capability, Surrogate-Control, TCN, TE, TRACE, Timeout, Title, Trailer, Transfer-Encoding, UA-Color, UA-Media, UA-Pixels, UA-Resolution, UA-Windowpixels, URI, Upgrade, User-Agent, Variant-Vary, Vary, Version, Via, Viewport-Width, WWW-Authenticate, Want-Digest, Warning, Width, X-Content-Duration, X-Content-Security-Policy, X-Content-Type-Options, X-CustomHeader, X-DNSPrefetch-Control, X-Forwarded-For, X-Forwarded-Port, X-Forwarded-Proto, X-Frame-Options, X-Modified, X-OTHER, X-PING, X-PINGOTHER, X-Powered-By, X-Requested-With

---

.htaccess Esempio (CORS inclusa):

<IfModule mod_headers.c> 
    Header unset Connection 
    Header unset Time-Zone 
    Header unset Keep-Alive 
    Header unset Access-Control-Allow-Origin 
    Header unset Access-Control-Allow-Headers 
    Header unset Access-Control-Expose-Headers 
    Header unset Access-Control-Allow-Methods 
    Header unset Access-Control-Allow-Credentials 

    Header set Connection       keep-alive 
    Header set Time-Zone       "Asia/Jerusalem" 
    Header set Keep-Alive       timeout=100,max=500 
    Header set Access-Control-Allow-Origin  "*" 
    Header set Access-Control-Allow-Headers  "Accept, Accept-CH, Accept-Charset, Accept-Datetime, Accept-Encoding, Accept-Ext, Accept-Features, Accept-Language, Accept-Params, Accept-Ranges, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin, Access-Control-Expose-Headers, Access-Control-Max-Age, Access-Control-Request-Headers, Access-Control-Request-Method, Age, Allow, Alternates, Authentication-Info, Authorization, C-Ext, C-Man, C-Opt, C-PEP, C-PEP-Info, CONNECT, Cache-Control, Compliance, Connection, Content-Base, Content-Disposition, Content-Encoding, Content-ID, Content-Language, Content-Length, Content-Location, Content-MD5, Content-Range, Content-Script-Type, Content-Security-Policy, Content-Style-Type, Content-Transfer-Encoding, Content-Type, Content-Version, Cookie, Cost, DAV, DELETE, DNT, DPR, Date, Default-Style, Delta-Base, Depth, Derived-From, Destination, Differential-ID, Digest, ETag, Expect, Expires, Ext, From, GET, GetProfile, HEAD, HTTP-date, Host, IM, If, If-Match, If-Modified-Since, If-None-Match, If-Range, If-Unmodified-Since, Keep-Alive, Label, Last-Event-ID, Last-Modified, Link, Location, Lock-Token, MIME-Version, Man, Max-Forwards, Media-Range, Message-ID, Meter, Negotiate, Non-Compliance, OPTION, OPTIONS, OWS, Opt, Optional, Ordering-Type, Origin, Overwrite, P3P, PEP, PICS-Label, POST, PUT, Pep-Info, Permanent, Position, Pragma, ProfileObject, Protocol, Protocol-Query, Protocol-Request, Proxy-Authenticate, Proxy-Authentication-Info, Proxy-Authorization, Proxy-Features, Proxy-Instruction, Public, RWS, Range, Referer, Refresh, Resolution-Hint, Resolver-Location, Retry-After, Safe, Sec-Websocket-Extensions, Sec-Websocket-Key, Sec-Websocket-Origin, Sec-Websocket-Protocol, Sec-Websocket-Version, Security-Scheme, Server, Set-Cookie, Set-Cookie2, SetProfile, SoapAction, Status, Status-URI, Strict-Transport-Security, SubOK, Subst, Surrogate-Capability, Surrogate-Control, TCN, TE, TRACE, Timeout, Title, Trailer, Transfer-Encoding, UA-Color, UA-Media, UA-Pixels, UA-Resolution, UA-Windowpixels, URI, Upgrade, User-Agent, Variant-Vary, Vary, Version, Via, Viewport-Width, WWW-Authenticate, Want-Digest, Warning, Width, X-Content-Duration, X-Content-Security-Policy, X-Content-Type-Options, X-CustomHeader, X-DNSPrefetch-Control, X-Forwarded-For, X-Forwarded-Port, X-Forwarded-Proto, X-Frame-Options, X-Modified, X-OTHER, X-PING, X-PINGOTHER, X-Powered-By, X-Requested-With" 
    Header set Access-Control-Expose-Headers  "Accept, Accept-CH, Accept-Charset, Accept-Datetime, Accept-Encoding, Accept-Ext, Accept-Features, Accept-Language, Accept-Params, Accept-Ranges, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Methods, Access-Control-Allow-Origin, Access-Control-Expose-Headers, Access-Control-Max-Age, Access-Control-Request-Headers, Access-Control-Request-Method, Age, Allow, Alternates, Authentication-Info, Authorization, C-Ext, C-Man, C-Opt, C-PEP, C-PEP-Info, CONNECT, Cache-Control, Compliance, Connection, Content-Base, Content-Disposition, Content-Encoding, Content-ID, Content-Language, Content-Length, Content-Location, Content-MD5, Content-Range, Content-Script-Type, Content-Security-Policy, Content-Style-Type, Content-Transfer-Encoding, Content-Type, Content-Version, Cookie, Cost, DAV, DELETE, DNT, DPR, Date, Default-Style, Delta-Base, Depth, Derived-From, Destination, Differential-ID, Digest, ETag, Expect, Expires, Ext, From, GET, GetProfile, HEAD, HTTP-date, Host, IM, If, If-Match, If-Modified-Since, If-None-Match, If-Range, If-Unmodified-Since, Keep-Alive, Label, Last-Event-ID, Last-Modified, Link, Location, Lock-Token, MIME-Version, Man, Max-Forwards, Media-Range, Message-ID, Meter, Negotiate, Non-Compliance, OPTION, OPTIONS, OWS, Opt, Optional, Ordering-Type, Origin, Overwrite, P3P, PEP, PICS-Label, POST, PUT, Pep-Info, Permanent, Position, Pragma, ProfileObject, Protocol, Protocol-Query, Protocol-Request, Proxy-Authenticate, Proxy-Authentication-Info, Proxy-Authorization, Proxy-Features, Proxy-Instruction, Public, RWS, Range, Referer, Refresh, Resolution-Hint, Resolver-Location, Retry-After, Safe, Sec-Websocket-Extensions, Sec-Websocket-Key, Sec-Websocket-Origin, Sec-Websocket-Protocol, Sec-Websocket-Version, Security-Scheme, Server, Set-Cookie, Set-Cookie2, SetProfile, SoapAction, Status, Status-URI, Strict-Transport-Security, SubOK, Subst, Surrogate-Capability, Surrogate-Control, TCN, TE, TRACE, Timeout, Title, Trailer, Transfer-Encoding, UA-Color, UA-Media, UA-Pixels, UA-Resolution, UA-Windowpixels, URI, Upgrade, User-Agent, Variant-Vary, Vary, Version, Via, Viewport-Width, WWW-Authenticate, Want-Digest, Warning, Width, X-Content-Duration, X-Content-Security-Policy, X-Content-Type-Options, X-CustomHeader, X-DNSPrefetch-Control, X-Forwarded-For, X-Forwarded-Port, X-Forwarded-Proto, X-Frame-Options, X-Modified, X-OTHER, X-PING, X-PINGOTHER, X-Powered-By, X-Requested-With" 
    Header set Access-Control-Allow-Methods  "CONNECT, DEBUG, DELETE, DONE, GET, HEAD, HTTP, HTTP/0.9, HTTP/1.0, HTTP/1.1, HTTP/2, OPTIONS, ORIGIN, ORIGINS, PATCH, POST, PUT, QUIC, REST, SESSION, SHOULD, SPDY, TRACE, TRACK" 
    Header set Access-Control-Allow-Credentials "true" 

    Header set DNT "0" 
    Header set Accept-Ranges "bytes" 
    Header set Vary "Accept-Encoding" 
    Header set X-UA-Compatible "IE=edge,chrome=1" 
    Header set X-Frame-Options "SAMEORIGIN" 
    Header set X-Content-Type-Options "nosniff" 
    Header set X-Xss-Protection "1; mode=block" 
</IfModule> 

---

F.A.Q:

• Perché Access-Control-Allow-Headers, Access-Control-Expose-Headers, Access-Control-Allow-Methods valori sono super a lungo?

  Quelli non supportano la sintassi *, così ho raccolto le intestazioni più comuni (ed esotici) di tutto il web, in vari formati #1#2#3 _{(e io aggiornare la lista di tanto in tanto)}

• Perché si utilizza la sintassi Header unset ______?

  I server GoDaddy (su cui è ospitato il mio sito Web ..) presentano un bug strano in cui se le intestazioni sono già impostate, il valore precedente si unirà a quello esistente .. (invece di sostituirlo) in questo modo pulite" valori esistenti _{(in realtà solo aa rapido & & sporca soluzione)}

• E 'sicuro per me di utilizzare 'così com'è'?

  Beh .. in gran parte la risposta sarebbe SI dal momento che il .htaccess sta limitando l'intestazioni per gli script (PHP, HTML, ...) e le risorse (.JPG, .JS, .CSS) servita dalle seguenti "cartella" -location. Opzionalmente potresti voler rimuovere le linee Access-Control-Allow-Methods. _{Inoltre Connection, Time-Zone, Keep-Alive e DNT, Accept-Ranges, Vary, X-UA-Compatible, X-Frame-Options, X-Content-Type-Options e X-Xss-Protection sono solo un suggerimento che sto usando per la mia linea-service .. sentitevi liberi di rimuovere quelli troppo ...}

_{preso dal mio comment above}