[英]ASP.NET Core CORS request blocked; why doesn't my API apply the right headers?
尝试使用身份验证设置 CORS。 我在http://localhost:61000 上有一个 Web API 站点,在http://localhost:62000 上有一个消费 Web 应用程序。 在 Web API Startup.cs 中,我有:
public void ConfigureServices(IServiceCollection services)
{
services.AddCors(o => o.AddPolicy("MyPolicy", corsBuilder =>
{
corsBuilder.WithOrigins("http://localhost:62000")
.AllowAnyMethod()
.AllowAnyHeader()
.AllowCredentials();
}));
IMvcBuilder builder = services.AddMvc();
// ...
}
// ...
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
app.UseCors("MyPolicy");
app.UseDeveloperExceptionPage();
app.UseDefaultFiles();
app.UseStaticFiles();
app.UseMvc();
}
所有的文件似乎都表明这应该是我所需要的。 在我的应用程序的 Javascript 中,我调用:
$.ajax({
type: 'POST',
url: "http://localhost:61000/config/api/v1/MyStuff",
data: matchForm.serialize(),
crossDomain: true,
xhrFields: { withCredentials: true },
success: function (data) {
alert(data);
}
});
我进入 Chrome: Failed to load http://localhost:61000/config/api/v1/MyStuff: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:62000' is therefore not allowed access.
Failed to load http://localhost:61000/config/api/v1/MyStuff: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:62000' is therefore not allowed access.
...在 Firefox 中: Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:61000/config/api/v1/MyStuff. (Reason: CORS header 'Access-Control-Allow-Origin' missing).
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:61000/config/api/v1/MyStuff. (Reason: CORS header 'Access-Control-Allow-Origin' missing).
我错过了什么? 我想,这应该是启用 CORS 所需的全部内容,但显然还缺少其他东西。
对于 ASP.NET Core 2.1 及更早版本:
我的代码中似乎有一个错误,但我得到了一个模糊的错误,而不是得到一个 ASP.NET 生成的错误页面。 事实证明,CORS 标头一开始确实被正确应用,但随后它们被剥离了任何 ASP.NET 中间件生成的错误。 另请参阅https://github.com/aspnet/Home/issues/2378 。
我用那个链接来找出这门课
using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;
namespace MySite.Web.Middleware
{
/// <summary>
/// Reinstates CORS headers whenever an error occurs.
/// </summary>
/// <remarks>ASP.NET strips off CORS on errors; this overcomes this issue,
/// explained and worked around at https://github.com/aspnet/Home/issues/2378 </remarks>
public class MaintainCorsHeadersMiddleware
{
public MaintainCorsHeadersMiddleware(RequestDelegate next)
{
_next = next;
}
private readonly RequestDelegate _next;
public async Task Invoke(HttpContext httpContext)
{
// Find and hold onto any CORS related headers ...
var corsHeaders = new HeaderDictionary();
foreach (var pair in httpContext.Response.Headers)
{
if (!pair.Key.ToLower().StartsWith("access-control-")) { continue; } // Not CORS related
corsHeaders[pair.Key] = pair.Value;
}
// Bind to the OnStarting event so that we can make sure these CORS headers are still included going to the client
httpContext.Response.OnStarting(o => {
var ctx = (HttpContext)o;
var headers = ctx.Response.Headers;
// Ensure all CORS headers remain or else add them back in ...
foreach (var pair in corsHeaders)
{
if (headers.ContainsKey(pair.Key)) { continue; } // Still there!
headers.Add(pair.Key, pair.Value);
}
return Task.CompletedTask;
}, httpContext);
// Call the pipeline ...
await _next(httpContext);
}
}
}
然后我将它添加到 Startup.cs 中的站点配置中:
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
app.UseCors(...);
app.UseMiddleware<MaintainCorsHeadersMiddleware>();
...
app.UseMvc();
}
此问题现已修复。 即使抛出异常并返回 500 响应,现在也会返回 CORS 标头。
当抛出异常并返回 500 响应时,CORS 标头会从响应中剥离。
我在使用 OWIN 中间件的 Web API 项目上遇到了同样的问题,其中错误的包版本导致 API 端出现错误(隐藏在客户端,因为响应中的 CORS 标头被剥离,这掩盖了原始错误)。 我实现了与您类似的解决方案,在这里分享,因为我在网上找不到任何使用 OWIN 的类似示例:
using System;
using System.Linq;
using System.Threading.Tasks;
using Owin;
using Microsoft.Owin;
using Microsoft.Owin.Cors;
namespace App_Server
{
using AppFunc = Func<IDictionary<string, object>, Task>;
partial class Startup
{
public void Configuration(IAppBuilder app)
{
app.UseCors(CorsOptions.AllowAll);
app.Use(new Func<AppFunc, AppFunc>(RetainHeaders));
....
(other startup tasks)
}
private AppFunc RetainHeaders(AppFunc next)
{
AppFunc appFunc = async (IDictionary<string, object> context) =>
{
IOwinContext httpContext = new OwinContext(context);
var corsHeaders = new HeaderDictionary(new Dictionary<string, string[]>());
foreach (var pair in httpContext.Response.Headers)
{
if (!pair.Key.ToLower().StartsWith("access-control-")) { continue; } //not a CORS header
corsHeaders[pair.Key] = pair.Value.First();
}
httpContext.Response.OnSendingHeaders(o =>
{
var localcontext = new OwinContext((IDictionary<string, object>)o);
var headers = localcontext.Response.Headers;
//make sure headers are present, and if not, add them back
foreach (var pair in corsHeaders)
{
if (headers.ContainsKey(pair.Key)) { continue; }
headers.Add(pair.Key, pair.Value);
}
}, context);
await next.Invoke(context);
};
return appFunc;
}
}
鉴于 OWIN 包对于 .Net 的文档记录很差,这是一个相当大的过程,所以我希望它可以帮助遇到它的其他人寻找解决方案。
在我的情况下,CORS 标头丢失了,因为我正在发出“应用程序/json”内容类型请求,而在 CORS 中,这种类型的请求首先发送一个 OPTIONS 方法,然后请求常规 POST。 但是 OPTIONS 是由我的 .Net Core 管道中的中间件代码管理的,如下所示:
if (context.Request.Method == "OPTIONS")
{
context.Response.StatusCode = (int)HttpStatusCode.OK;
await context.Response.WriteAsync(string.Empty);
}
一旦我删除了中间件,这些请求就会得到完美的处理。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.