瓶子 PY：响应预检请求，无“访问控制允许来源”header

Question

I am developing a little web app and on my end everything works fine, but when my colleague tries it out on his end the gets this CORS error:

Access to XMLHttpRequest at 'http://localhost:3333/registerPID/' from origin 'null' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

The server is running on localhost:3333 and is written in Python using the Bottle Framework. The browser sends a POST Request with some user data to the server and the server then responds with a PID. I also added the CORS headers to the response but it still doesn't seem to work for him: Decorator:

def enable_cors(fn):
        def _enable_cors(*args, **kwargs):
            # set CORS headers
            response.headers['Access-Control-Allow-Origin'] = '*'
            response.headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, OPTIONS'
            response.headers['Access-Control-Allow-Headers'] = 'Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token'

            if bottle.request.method != 'OPTIONS':
                # actual request; reply with the actual response
                return fn(*args, **kwargs)
        return _enable_cors

Route for the POST request (formatting is off on here, is correct in the code):

@route("/registerPID/", method='POST')
@enable_cors
    def register_PID():
        register_data = request.body.getvalue().decode('utf-8')
        register_values = []
        register_values.append(register_data.split(','))
        print(register_values[0][3])

        with open('pidList.csv', newline='') as csvfile:
            reader = csv.DictReader(csvfile)
            maxID = -1

            for row in reader:
                maxID += 1
                print(register_values[0][3])
                if row['uniqueBrowserID'] == register_values[0][3]:
                    if row['hasFinished'] == str(0):
                        failed_pid = row['ID']
                        for x in range(6):
                            file_path = log_path + failed_pid + '-' + str(x) + ".csv"
                            if os.path.isfile(file_path):
                                shutil.move(file_path,failed_log_path + failed_pid + '-' + str(x) + ".csv")
                        print("re play: " + str(maxID))
                        return str(maxID)
                    else:
                        return "f1"
            with open("pidList.csv", "a") as csvfile:
                id = maxID + 1
                writer = csv.writer(csvfile, delimiter=',')
                writer.writerow([register_values[0][0],register_values[0][1],register_values[0][2],id,0,register_values[0][3],register_values[0][4]])
                return str(id)

Browser Ajax Call:

function getPidCall(formCsvData) {
    $.ajax({
        url: "http://localhost:3333/registerPID/",
        type: "POST",
        data: formCsvData,
        contentType: "text",
        dataType: "text",
        async: true,
        success: function (response) {
            pid = response;
            if (isNaN(response)) {
                hasAlreadyParticipated = true
                pid = 0
            }
            removeStartScreeen()
            startScreenIsActive = false
            setupScene()
            requestLock();
        }
    });

}

How do I fix this?

Answer 1

My guess is that you've failed to include OPTIONS in your method list. Does this work any better:

@route("/registerPID/", method=['POST', 'OPTIONS'])
@enable_cors
    def register_PID():
    ...