使用XMLHttpRequest從WebExtension訪問Rest Service時出錯

Question

我正在嘗試從firefox WebExtension訪問在Amazon AWS服務器上托管的REST服務。

我已經在manifest.json中注冊了一個后台腳本，然后嘗試訪問該服務。

"background": {
    "scripts": ["OwnerLangBackground.js"]
},
"permissions": [
    "*://ec2-35-158-91-62.eu-central-1.compute.amazonaws.com:9000/*"
]

但是，XMLHttpRequest只是返回一個錯誤，但是我看不出什么地方出了問題。 在研究此問題時，我偶然發現了以下頁面： https : //mathiasbynens.be/notes/xhr-responsetype-json

現在，我用上面鏈接中的代碼副本（略作修改）替換了我自己的代碼：

// OwnerLangBackground.js
console.log("OwnerLangBackground.js loaded");
var getJSON = function(url, successHandler, errorHandler) {
    var xhr = new XMLHttpRequest();
    xhr.open('get', url, true);
    xhr.onreadystatechange = function() {
        var status;
        var data;
        // https://xhr.spec.whatwg.org/#dom-xmlhttprequest-readystate
        if (xhr.readyState == 4) { // `DONE`
            status = xhr.status;
            if (status == 200) {
                data = JSON.parse(xhr.responseText);
                successHandler && successHandler(data);
            } else {
                errorHandler && errorHandler(status, xhr.responseText);
            }
        }
    };
    xhr.send();
};

/* BLOCK 1: removing the comments for this block works
getJSON('https://mathiasbynens.be/demo/ip', function(data) {
    console.log('Your public IP address is: ' + data.ip);
    console.log('Your response is: ', data);
}, function(status) {
    console.warn('Something went wrong.', status);
});
*/

/* BLOCK 2: removing the comments for this block, does not work
getJSON('http://ec2-35-158-91-62.eu-central-1.compute.amazonaws.com:9000/get-languages', function(data) {
    console.log('Your response is: ', data);
}, function(status) {
    console.warn('Something went wrong.', status);
});
*/

奇怪的是，激活BLOCK 1可以按預期工作（故意掩蓋了IP地址）。

    OwnerLangBackground.js loaded
    Your public IP address is: xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xx
    Your response is:  Object { ip: "xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:…" }

激活塊2會導致錯誤響應。

    OwnerLangBackground.js loaded
    Something went wrong. 0

但是，如果我直接使用curl調用這兩個URL，它們都將返回有效的JSON：

    > curl https://mathiasbynens.be/demo/ip
    {"ip":"xxxx:xxxx:xxxx::xxx"}

    > curl http://ec2-35-158-91-62.eu-central-1.compute.amazonaws.com:9000/get-languages
    [{"language":"??"},{"language":"de"},{"language":"en"},{"language":"fr"},{"language":"it"}]

我已將調試輸出添加到AWS服務器上的rest服務中，並且看到它被調用了。 我還在運行WebExtension的本地計算機上使用Wireshark將WebExtension調用跟蹤到了其余服務，並且可以看到返回了JSON字符串，因此我猜測該錯誤發生在firefox / webextension中。不知所措。

我考慮過的事情：

• 清單中的權限：據我所知，aws-url的URL模式已正確添加。 但是，即使我尚未將URL添加到權限中，也可以調用mathiasbynens.be
• 有效的呼叫使用https，而無效的呼叫使用http。 這可能是原因嗎？

誰能指出我正確的方向，以獲取更多關於發生問題的反饋？ 我嘗試過向xhr請求添加onerror回調。 它被稱為，但據我所知沒有提供更多信息。

更新：我又提出了兩個想法。 使用curl -v為我提供了標題：

> curl -v http://ec2-35-158-91-62.eu-central-1.compute.amazonaws.com:9000/get-languages
* Hostname was NOT found in DNS cache
*   Trying 35.158.91.62...
* Connected to ec2-35-158-91-62.eu-central-1.compute.amazonaws.com (35.158.91.62) port 9000 (#0)
> GET /get-languages HTTP/1.1
> User-Agent: curl/7.38.0
> Host: ec2-35-158-91-62.eu-central-1.compute.amazonaws.com:9000
> Accept: */*
>
< HTTP/1.1 200
< Content-Type: application/json;charset=UTF-8
< Transfer-Encoding: chunked
< Date: Sun, 23 Apr 2017 06:43:42 GMT
<
* Connection #0 to host ec2-35-158-91-62.eu-central-1.compute.amazonaws.com left intact
[{"language":"??"},{"language":"de"},{"language":"en"},{"language":"fr"},{"language":"it"}]


> curl -v https://mathiasbynens.be/demo/ip
* Hostname was NOT found in DNS cache
*   Trying 2a01:1b0:7999:402::144...
* Connected to mathiasbynens.be (2a01:1b0:7999:402::144) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* Server certificate:
*        subject: OU=Domain Control Validated; OU=PositiveSSL Wildcard; CN=*.mathiasbynens.be
*        start date: 2015-07-28 00:00:00 GMT
*        expire date: 2018-08-12 23:59:59 GMT
*        subjectAltName: mathiasbynens.be matched
*        issuer: C=GB; ST=Greater Manchester; L=Salford; O=COMODO CA Limited; CN=COMODO RSA Domain Validation Secure Server CA
*        SSL certificate verify ok.
> GET /demo/ip HTTP/1.1
> User-Agent: curl/7.38.0
> Host: mathiasbynens.be
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Sun, 23 Apr 2017 06:44:16 GMT
* Server Apache is not blacklisted
< Server: Apache
< Access-Control-Allow-Origin: *
< Strict-Transport-Security: max-age=15768000; includeSubDomains
< Vary: Accept-Encoding
< Cache-Control: max-age=0
< Expires: Sun, 23 Apr 2017 06:44:16 GMT
< X-UA-Compatible: IE=edge
< X-Content-Type-Options: nosniff
< X-Frame-Options: DENY
< X-XSS-Protection: 1; mode=block
< Transfer-Encoding: chunked
< Content-Type: application/json;charset=UTF-8
<
* Connection #0 to host mathiasbynens.be left intact
{"ip":"xxxx:xxxx:xxxx::xxx"}

突出的一個區別是我的休息服務的響應缺少Transfer-Encoding和Access-Control-Allow-Origin? 標頭，因此我將考慮添加這些標頭。

但是，如果有人對如何獲取有關XmlHttpRequest發生問題的更多錯誤信息有任何提示，我將很高興聽到它。

Answer 1

好的，看來缺少Access-Control-Allow-Origin? 標頭是我問題的根源。

現在，我通過添加另一個方法參數HttpServletResponse response ，然后對該參數調用setHeader()來更改Spring-RestControllers中的所有方法。

@RequestMapping("/get-languages")
public @ResponseBody List<Language> getLanguages(HttpServletResponse  response) {
    response.setHeader("Content-Type", "application/json;charset=UTF-8");
    response.setHeader("Access-Control-Allow-Origin", "*");
    return languageRepository.findAll();
}

現在，我的WebExtension可以通過XmlHttpRequest成功使用此rest服務。

如果此信息（缺少CORS標頭）在firefox的調試或js控制台中的某個位置可見，那將是有幫助的，因此，如果有人可以告訴我我怎么會看到此信息，我仍然希望得到一個提示。