[英]'Request header field Authorization is not allowed' error - Tastypie
I am getting the following error while using ApiKeyAuthentication for my Tastypie resources when I try to do an HTTP request using AJAX and Tastypie: 当我尝试使用AJAX和Tastypie执行HTTP请求时,在为Tastypie资源使用ApiKeyAuthentication时出现以下错误:
XMLHttpRequest cannot load http://domain.com/api/v1/item/?format=json&username=popo&api_key=b83d21e2f8bd4952a53d0ce12a2314c0ffa031b1. Request header field Authorization is not allowed by Access-Control-Allow-Headers.
Any ideas on how to solve this? 关于如何解决这个问题的任何想法?
Here are the request headers from Chrome: 以下是Chrome的请求标头:
Request Headersview source
Accept:*/*
Accept-Charset:
ISO-8859-1,utf-8;q=0.7,*;q=0.3
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Access-Control-Request-Headers:
origin, authorization, access-control-allow-origin, accept, access-control-allow-headers
Access-Control-Request-Method:
GET
Here are the response headers from Chrome: 以下是Chrome的响应标头:
Response Headersview source
Access-Control-Allow-Headers:
Origin,Content-Type,Accept,Authorization
Access-Control-Allow-Methods:
POST,GET,OPTIONS,PUT,DELETE
Access-Control-Allow-Origin:*
Connection:keep-alive
Content-Length:0
Content-Type:
text/html; charset=utf-8
Date:Fri, 11 May 2012 21:38:35 GMT
Server:nginx
As you can see, they both have headers for Authorization, yet authorization does not work. 如您所见,它们都有用于授权的标头,但授权不起作用。
Here is the django middleware that I am using to edit the response headers: https://gist.github.com/1164697 这是我用来编辑响应头的django中间件: https : //gist.github.com/1164697
Edit: I figured out the problem. 编辑:我发现了问题。 I was trying to connect to www.domain.com, and it only accepts domain.com
我试图连接到www.domain.com,它只接受domain.com
Antyrat's answer is not complete. Antyrat的答案并不完整。
You have to specify which headers your server allows; 您必须指定服务器允许的标头; in your case Authorization .
在您的情况下授权 。
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: Authorization
This happens because of Same origin policy . 这是因为同源策略 。
You need to make AJAX call from same domain where request goes. 您需要从请求所在的同一域进行AJAX调用。 Or make server-side changes, allowing requests from external domains.
或者进行服务器端更改,允许来自外部域的请求。
To resolve this you need to make changes in headers at http://domain.com by allowing your external domain in headers: 要解决此问题,您需要在http://domain.com中对标头进行更改,方法是在标头中添加外部域:
Access-Control-Allow-Origin: *
Although I upvoted the answer of @Manuel Bitto, 虽然我赞成@Manuel Bitto的答案,
I would like to post another answer which contains a complete Cors Filter that works for me with Apache tomcat 5.x: 我想发布另一个答案,其中包含一个完整的Cors Filter,它适用于Apache tomcat 5.x:
public class CorsFilter implements Filter {
public CorsFilter() { }
public void init(FilterConfig fConfig) throws ServletException { }
public void destroy() { }
public void doFilter(
ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
HttpServletResponse httpServletResponse = (HttpServletResponse)response;
httpServletResponse.addHeader("Access-Control-Allow-Origin", "*");
httpServletResponse.addHeader("Access-Control-Allow-Methods", "GET, POST, PUT, OPTIONS, DELETE");
httpServletResponse.addHeader("Access-Control-Allow-Headers", "Authorization");
chain.doFilter(request, response);
}
}
I would suggest to specifically pay attention to the addition of OPTIONS to to the "Access-Control-Allow-Methods" header values. 我建议特别注意向“Access-Control-Allow-Methods”标题值添加OPTIONS。
The reason for doing that is that according to the explanation provided here by Mozilla, 这样做的原因是,根据提供的说明这里由Mozilla,
if your request (let's say POST) contains a special header, or content type (and this is my case), then the XMLHttpRequest object will generate an additional OPTIONS call, which you need to address in your code. 如果您的请求(假设是POST)包含特殊标头或内容类型(这是我的情况),那么XMLHttpRequest对象将生成一个额外的OPTIONS调用,您需要在代码中解决该调用。
I hope this helps. 我希望这有帮助。
The problem was that www.domain.com was seen as different than domain.com. 问题是www.domain.com被认为与domain.com不同。 domain.com worked, but when I used www.domain.com, it detected me as doing requests from a different domain
domain.com工作,但当我使用www.domain.com时,它检测到我做了来自不同域的请求
I know this question is older. 我知道这个问题比较老了。
But today I ran into same cors issue after adding owin. 但是今天我加入了owin后遇到了同样的问题。 After number of search on google and trying various solutions.
经过多次搜索谷歌和尝试各种解决方案。 I solved cors issue by adding below
我在下面添加了解决了cors问题
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<remove name="OPTIONSVerbHandler" />
<remove name="TRACEVerbHandler" />
For more details please follow the below links. 有关详细信息,请按照以下链接。 Thanks.
谢谢。
[ http://benfoster.io/blog/aspnet-webapi-cors] [ http://benfoster.io/blog/aspnet-webapi-cors]
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.