访问控制 - 允许 - 来源不允许

Question

为什么我的网址已经在Access-Control-Allow-Origin的头部了！

错误

XMLHttpRequest cannot load http://cdn.localhost/data/voucher/16_ead32751b66fd6c7856b7db0e186574df37a7d08.pdf. Origin http://secure.localhost is not allowed by Access-Control-Allow-Origin. 
Refused to get unsafe header "Accept-Ranges" 

htaccess的（cdn.localhost）

Header add Access-Control-Allow-Origin "http://secure.localhost" 

Answer 1

也可以尝试从this post发送以下标题：

// Specify domains from which requests are allowed 
header('Access-Control-Allow-Origin: *'); 

// Specify which request methods are allowed 
header('Access-Control-Allow-Methods: GET, POST, OPTIONS'); 

// Additional headers which may be sent along with the CORS request 
// The X-Requested-With header allows jQuery requests to go through 
header('Access-Control-Allow-Headers: X-Requested-With'); 

// Set the age to 1 day to improve speed/caching. 
header('Access-Control-Max-Age: 86400'); 

Answer 2

为规范访问控制 - 允许 - Origin谈到空格分隔的URL语法。也许第二次出现的头部会覆盖客户端中的第一个 - 在单个头部中尝试多值版本。