节点快递网站与 REST 身份验证 API - CORS 问题

Question

I am new to nodejs + Express but I'm trying to build a very quick proof of concept website which allows user to authenticate via a REST API.

I have come against a CORS problem and despite installing the cors module and using it as suggested in the documentation , I am still getting the following error:

Access to XMLHttpRequest at xxx has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The 'Access-Control-Allow-Origin' header has a value ' https://www.example.com ' that is not equal to the supplied origin.

Here is my (simplified) code:

app.js

const express = require('express');
const expressLayouts = require('express-ejs-layouts');
const cors = require('cors');

compression = require('compression'),
shouldCompress = (req, res) => {
    if (req.headers['x-no-compression']) {
      // don't compress responses if this request header is present
      return false;
    }
    // fallback to standard compression
    return compression.filter(req, res);
  };

const app = express();


// EJS
app.use(expressLayouts);
app.set('view engine', 'ejs');

// Parsing related
app.use(express.urlencoded( { extended: false })); //Parse URL-encoded bodies
app.use(express.json()); //Used to parse JSON bodies

app.use(compression({
    filter:shouldCompress,
    threshold: 3
}));

app.use(express.static('public'));
app.disable('x-powered-by');


// Using the flash middleware provided by connect-flash to store messages in session
// and displaying in templates
const flash = require('connect-flash');
app.use(flash());

// Sessions
const session = require('express-session');

app.use(session({
  secret: 'fat cat 42',
  resave: false,
  saveUninitialized: true,
  cookie: { secure: true }
}));

// Initialize Passport and restore authentication state, if any, from the session.
const passport = require('passport');
require ('./config/passport')(passport);
app.use(passport.initialize());
app.use(passport.session())

// Routes
app.use('/', require('./routes/index'));
app.use('/member', require('./routes/users'));


const PORT = process.env.PORT || 5000;

app.listen(PORT, console.log(`Server started on port: ${PORT}`));

users.js

const express = require('express');
const router = express.Router();
const passport = require('passport');

require ('../config/passport')(passport);


router.post('/signin', passport.authenticate('facebook', {
    successRedirect : '/home',
    failureRedirect : '/'
  }));

module.exports = router;

Here is the script portion of the view that makes the AJAX POST

homepage.ejs

   $(document).ready(function(){
      $('#demo').click(function(e){
        $.ajax({
          method: "POST",
          url: "/member/signin",
          data: {
            "source": $(this).attr('id')
          },
          dataType: "json",
          timeout: 5000 // 5000ms
        }).done(function(data) {
          // is called if request is successful
          console.log('Success:' + data);
        }).fail(function(jqXHR, status) {
          // is called if request fails or timeout is reached
          alert('Request could not complete: ' + status);
        });
      });
    });

How do I fix this so that the AJAX calls work?

Answer 1

essentially you need to permit cross-site origin requests. you do that by setting the access-control-headers normally with some proxy like nginx in front of your node server like the following (it is not recommended to have node directly exposed on port 80)

#nginx config
if ($request_method = 'OPTIONS') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Credentials' 'true';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, HEAD, DELETE, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With';
    return 204;
}

if you have expressjs you could use this cors middleware

var express = require('express')
var cors = require('cors')
var app = express()

app.use(cors())

app.post('/signin/', function (req, res, next) {
    // ....
})