为什么 ServiceStack 不将 Access-Control-Allow-Origin 标头添加到 GET 请求中？

Question

我将 ServiceStack 配置为启用 CORS：

Plugins.Add( new CorsFeature(
    allowOriginWhitelist: new List<string>() { "http://localhost", "http://localhost:8080" },
    allowCredentials: true,
    allowedHeaders: "Content-Type, Allow, Authorization"
) );

PreRequestFilters.Add( ( request, response ) =>
{
    if( request.Verb == "OPTIONS" )
    {
        response.EndRequest();
    }
} );

OPTIONS 请求和响应看起来很棒，并且以 http://localhost:8080 为源成功。但是，随后的 GET 失败，因为根据 Chrome 的说法，它缺少 Access-Control-Allow-Origin 标头。

这是错误：

请求的资源上不存在“Access-Control-Allow-Origin”标头。 Origin http://localhost:8080 因此不允许访问。

这是请求：

GET /app/api/operations/metadata HTTP/1.1
Host: dummy.domain.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Content-Type: application/json; charset=utf-8
Referer: http://localhost:8080/dev.html
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8

下面是回复：

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json; charset=utf-8
Vary: Accept
Server: Microsoft-IIS/7.5
X-Powered-By: ServiceStack/4.034 Win32NT/.NET
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Allow, Authorization
Access-Control-Allow-Credentials: true
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sat, 20 Dec 2014 17:22:38 GMT
Content-Length: 38203

注意缺少的 Access-Control-Allow-Origin 标头。

Answer 1

ServiceStack 的 CorsFeature already handles OPTIONS requests，因此您需要删除它，这样它就不会使请求短路。

//Should be removed
PreRequestFilters.Add((request,response) => {
    if (request.Verb == "OPTIONS" )
    {
        response.EndRequest();
    }
});

WhiteList 添加到自定义 Http 处理程序

我在 /operations/metadata in this commit 等自定义 Http 处理程序中添加了对源白名单的支持。这现在可以按预期工作，如 http://test.servicestack.net (source code) 中所示：

HTTP 请求

GET http://test.servicestack.net/operations/metadata HTTP/1.1
Host: test.servicestack.net
Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Origin: http://localhost:8080

HTTP 响应

HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html
Vary: Accept
Server: Microsoft-IIS/8.5
Access-Control-Allow-Origin: http://localhost:8080
X-Powered-By: ServiceStack/4.00 Win32NT/.NET
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Allow, Authorization
Access-Control-Allow-Credentials: true
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Sun, 21 Dec 2014 00:30:39 GMT
Content-Length: 17027

此更改从 v4.0.35+ 可用，现在是 available on MyGet。