CORS 适用于 localhost 但不适用于生产服务器

Question

我通过安装必要的 nuget 包并在我的 web api 配置类中调用 config.EnableCors()，为我的 REST API（使用 ASP.NET Web API 技术开发）启用了跨域资源共享 (CORS)。

当我尝试从 localhost 上的另一个普通 html 站点对在我的 localhost 上运行的应用程序进行跨站点调用时，这种单一的更改似乎已经奏效，之前由于单一来源限制而失败。

现在已将此更新部署到生产测试环境，但似乎无法正常工作。几乎把我所有的头发都拉出来寻找解决方案。也许有人可以帮我找出我错过的东西。

Answer 1

您是否使用EnableCors 属性标记了您的控制器？

例如来自Enabling Cross-Origin Requests in ASP.NET Web API 2

using System.Net.Http;
using System.Web.Http;
using System.Web.Http.Cors;

namespace WebService.Controllers
{
    [EnableCors(origins: "http://mywebclient.azurewebsites.net", headers: "*", methods: "*")]
    public class TestController : ApiController
    {
        // Controller methods not shown...
    }
}

Answer 2

我也有同样的问题。

使用此工具进行调查：

https://www.test-cors.org

https://www.test-cors.org/#?client_method=GET&client_credentials=true&client_headers=X-Api-Version%3A%202.0&server_url=http%3A%2F%2Falfa.jobit.io&server_enable=true&server_status=200&server_credentials=true&server_methods=POST%2C%20GET%2C%20OPTIONS&server_headers=X-Api-Version&server_tabs=local

还没有解决办法！

发送选项但没有实际请求。以下是它在 Wireshark 中的样子：

我花了 50 多个小时学习 CROSS。直到我意识到 localhost 的行为有所不同。

Preflight 在我添加 custom headers（在本例中为 api-version）后使用。 在 localhost 和生产环境中，prelight 返回成功。我还在调查中，解决后我会完成这个答案。

这是我在 localhost 上运行的服务器成功 CROSS 的标头：

############ Request Headers (OPTIONS) ############

=== Request Details ===

Access-Control-Request-Method: GET
Origin: http://alfa.example.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.20 Safari/537.36
Access-Control-Request-Headers: api-version
Accept: */*

############ Response Headers (Get) ############

=== Request Details ===

Connetion: Close
Date: Mon, 29 Oct 2018 19:50:40 GMT
Content-Type: application/json
Server: Kestrel
Transfer-Encoding: identity
Content-Encoding: identity
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: api-version, Accept-Encoding, Accept-Language, User-Agent, Host, Connection, Authorization, timezone, X-CSRF-Token, Origin, X-Requested-With, Accept, Content-Type, Accept-Version, Content-Length, Content-MD5, Date, X-Api-Version, X-File-Name
Access-Control-Allow-Methods: POST, GET, PUT, PATCH, DELETE, OPTIONS
Access-Control-Allow-Origin: http://alfa.example.io
Request-Context: appId=cid-v1:0bdcbef4-4877-4790-bf3a-93aa6498f4df

############ Request Headers (GET) ############

=== Request Details ===

Accept: application/json, text/plain, */*
Origin: http://alfa.example.io
api-version: 2.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.20 Safari/537.36

############ Request Finished (Options) ############

=== Request ===

Method: GET
URL:    http://localhost:5000/contacts/register/23

=== XHR Headers ===

Pragma: no-cache
Access-Control-Request-Method: GET
Origin: http://alfa.example.io
Accept-Encoding: gzip, deflate, br
Host: localhost:5000
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.20 Safari/537.36
Accept: */*
Cache-Control: no-cache
Referer: http://alfa.example.io/?debug=&invitation=CB89EDA9-C305-464E-99A9-8AA861F44A6F
Connection: keep-alive
Access-Control-Request-Headers: api-version

############ Response Headers (Get) ############

=== Request Details ===

Date: Mon, 29 Oct 2018 19:50:40 GMT
Content-Type: application/json; charset=utf-8
Server: Kestrel
Cache-Control: no-cache
Pragma: no-cache
Transfer-Encoding: chunked
Expires: -1
Vary: Origin
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: api-version, Accept-Encoding, Accept-Language, User-Agent, Host, Connection, Authorization, timezone, X-CSRF-Token, Origin, X-Requested-With, Accept, Content-Type, Accept-Version, Content-Length, Content-MD5, Date, X-Api-Version, X-File-Name
Access-Control-Allow-Methods: POST, GET, PUT, PATCH, DELETE, OPTIONS
Access-Control-Allow-Origin: http://alfa.example.io
Request-Context: appId=cid-v1:0bdcbef4-4877-4790-bf3a-93aa6498f4df
Api-Supported-Version: 2.0

############ Request Finished (GET) ############

=== Request ===

Method: GET
URL:    http://localhost:5000/contacts/register/23

=== XHR Headers ===

Pragma: no-cache
Origin: http://alfa.example.io
Accept-Encoding: gzip, deflate, br
Host: localhost:5000
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
api-version: 2.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.20 Safari/537.36
Accept: application/json, text/plain, */*
Cache-Control: no-cache
Referer: http://alfa.example.io/?debug=&invitation=CB89EDA9-C305-464E-99A9-8AA861F44A6F
Cookie: _ga=GA1.1.2021313723.1538951960; __test=1; _gid=GA1.1.1427728347.1540763978
Connection: keep-alive