PHP 标头函数会覆盖 htaccess 标头吗？

Question

Setting headers in PHP

header("Access-Control-Allow-Origin: https://www.example.com");
header("Access-Control-Allow-Headers: Content-Type, Content-Range, Content-Disposition, Content-Description");
    

Header set in .htaccess

SetEnvIf Origin ^(https?://.+\.(example|gstatic)\.com(?::\d{1,5})?)$   CORS_ALLOW_ORIGIN=$1
Header append Access-Control-Allow-Origin  %{CORS_ALLOW_ORIGIN}e   env=CORS_ALLOW_ORIGIN

Header set Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header set Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

Header merge  Vary "Origin"

I'd rather not edit the .htaccess file. Does the PHP header() function overwrite?

Answer 1

Without editing your .htaccess , it's going to be difficult, but if you allow yourself a small edit, you can make it work.

The Header Apache2 documentation says:

This directive can replace, merge or remove HTTP response headers. The header is modified just after the content handler and output filters are run, allowing outgoing headers to be modified.

So it happens after PHP (aka content handler ).

However, if we look at the syntax of the option:

Header [condition] add|append|echo|edit|edit*|merge|set|setifempty|unset|note header [[expr=]value [replacement] [early|env=[!]varname|expr=expression]]

we see that one of the actions is setifempty . This is what you actually want to use. The set overwrites the value. setifempty sets the value if not already set.

Header setifempty Access-Control-Allow-Headers "origin, x-requested-with, content-type"
Header setifempty Access-Control-Allow-Methods "PUT, GET, POST, DELETE, OPTIONS"

Here is that option description:

setifempty
The request header is set, but only if there is no previous header with this name.

Note:

There is a comment about using the header_remove() PHP instruction. Only that happens at the time PHP runs which is before the Apache2 Header is applied. So it wouldn't work.