[英]No 'Access-Control-Allow-Origin' header is present on the requested resource Django and ReactJS
Currently I have Django 1.98 as Backend and React as Front End.目前我有Django 1.98作为后端和 React 作为前端。
I'm getting this error:我收到此错误:
Access to XMLHttpRequest at ' https://mywebsite:8000/uploads/vtt/ ' from origin ' http://localhost:3000 ' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
从源“ http://localhost:3000 ”访问“ https://mywebsite:8000/uploads/vtt/ ”的 XMLHttpRequest 已被 CORS 策略阻止:没有“Access-Control-Allow-Origin”标头存在于请求的资源。
I installed django-cors-headers==2.4.0 on my virtualenviroment我在我的虚拟环境中安装了django-cors-headers==2.4.0
This is my settings.py file:这是我的settings.py文件:
INSTALLED_APPS = [
'django.contrib.admin',
'django.contrib.auth',
'django.contrib.contenttypes',
'django.contrib.sessions',
'django.contrib.messages',
'django.contrib.staticfiles',
'uploads.core',
'corsheaders',
]
MIDDLEWARE_CLASSES = [
'django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'corsheaders.middleware.CorsMiddleware',
'django.middleware.common.CommonMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'django.middleware.clickjacking.XFrameOptionsMiddleware',
]
CORS_ORIGIN_ALLOW_ALL = True
CSRF_TRUSTED_ORIGINS = ['http://127.0.0.1:3000','http://localhost:3000','http://localhost:8000','https://mywebsite:8000','https://myapp.firebaseapp.com','https://mywebsite:8088']
CSRF_COOKIE_NAME = "csrftoken"
CSRF_HEADER_NAME = [
'HTTP_X_CSRFTOKEN'
]
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
CORS_ORIGIN_WHITELIST = ['http://localhost:3000','https://mywebsite:8088']
CORS_ALLOW_METHODS = (
'DELETE',
'GET',
'OPTIONS',
'PATCH',
'POST',
'PUT',
)
CORS_ALLOW_HEADERS = (
'accept',
'accept-encoding',
'authorization',
'content-type',
'dnt',
'origin',
'user-agent',
'x-csrftoken',
'x-requested-with',
)
Any idea how to solve it?知道如何解决吗? Thanks.
谢谢。
Make sure https://mywebsite:8000/uploads/vtt/
is the correct URL.确保
https://mywebsite:8000/uploads/vtt/
是正确的 URL。
In my case, I used the wrong port because my API used a different port.就我而言,我使用了错误的端口,因为我的 API 使用了不同的端口。
I replaced 8000
with 52130
.我用
52130
替换了8000
。
Try adding:尝试添加:
CORS_ORIGIN_WHITELIST = (
'example.com',
'localhost:3000',
'127.0.0.1:3000',
'more.domain.or.subdomains'
)
Don't forget add the middleware too不要忘记添加中间件
MIDDLEWARE = [ # Or MIDDLEWARE_CLASSES on Django < 1.10
...
'corsheaders.middleware.CorsMiddleware',
'django.middleware.common.CommonMiddleware',
...
]
django-cors-headers
is reasonably fool-proof and your configuration seems correct to me. django-cors-headers
是相当django-cors-headers
,你的配置对我来说似乎是正确的。
There is however a gotcha I've had issues with too: Your uploads directory is likely not served through Django, but by the server directly as a static file (best practice and nearly default behaviour in Django).然而,我也遇到了一个问题:您的上传目录可能不是通过 Django 提供的,而是由服务器直接作为静态文件提供的(Django 中的最佳实践和几乎默认行为)。 Even the built-in development server will serve static files without invoking your Django app.
即使是内置的开发服务器也可以在不调用 Django 应用程序的情况下提供静态文件。
Since your app is not invoked, django-cors-headers
cannot apply a CORS header to those responses.由于未调用您的应用程序,因此
django-cors-headers
无法将 CORS 标头应用于这些响应。
I had the same issue, and I think is a problem with:我有同样的问题,我认为是一个问题:
SECURE_SSL_REDIRECT = True
I don't know the impacts over disabling it, but setting it to:我不知道禁用它的影响,但将其设置为:
SECURE_SSL_REDIRECT = False
This make the cors problem gone.这使得 cors 问题消失了。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.