如何在Nginx代理服务器中启用CORS？

Question

正如我的标题，这里是位于conf.d/API-server.conf中

server { 
    listen 80; 
    server_name api.localhost; 

    location/{ 
    add_header 'Access-Control-Allow-Origin' 'http://api.localhost'; 
    add_header 'Access-Control-Allow_Credentials' 'true'; 
    add_header 'Access-Control-Allow-Headers' 'Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range'; 
    add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS,PUT,DELETE,PATCH'; 

    if ($request_method = 'OPTIONS') { 
     add_header 'Access-Control-Max-Age' 1728000; 
     add_header 'Content-Type' 'text/plain charset=UTF-8'; 
     add_header 'Content-Length' 0; 
     return 204; 
    } 

    proxy_redirect off; 
    proxy_set_header host $host; 
    proxy_set_header X-real-ip $remote_addr; 
    proxy_set_header X-forward-for $proxy_add_x_forwarded_for; 
    proxy_pass http://127.0.0.1:3000; 
    } 
} 

的nginx.conf文件保持不变为默认的配置文件。

后，我发送请求api.localhost（api.localhost /管理/登录），我仍然收到405错误：

XMLHttpRequest cannot load http://api.localhost/admin/login. Response 
to preflight request doesn't pass access control check: No 'Access- 
Control-Allow-Origin' header is present on the requested resource. 
Origin 'http://admin.localhost:3000' is therefore not allowed access. 
The response had HTTP status code 405. 

Answer 1

的问题是，你如果条件不要在/的父级中发送标题。如果你检查预检应答头，它将是

HTTP/1.1 204 No Content 
Server: nginx/1.13.3 
Date: Fri, 01 Sep 2017 05:24:04 GMT 
Connection: keep-alive 
Access-Control-Max-Age: 1728000 
Content-Type: text/plain charset=UTF-8 
Content-Length: 0 

而这并没有给任何东西。所以你有两个可能的修复。复制add_header如果里面块也

server { 
    listen 80; 
    server_name api.localhost; 

    location/{ 
    add_header 'Access-Control-Allow-Origin' 'http://api.localhost'; 
    add_header 'Access-Control-Allow_Credentials' 'true'; 
    add_header 'Access-Control-Allow-Headers' 'Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range'; 
    add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS,PUT,DELETE,PATCH'; 

    if ($request_method = 'OPTIONS') { 
     add_header 'Access-Control-Allow-Origin' 'http://api.localhost'; 
     add_header 'Access-Control-Allow_Credentials' 'true'; 
     add_header 'Access-Control-Allow-Headers' 'Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range'; 
     add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS,PUT,DELETE,PATCH'; 
     add_header 'Access-Control-Max-Age' 1728000; 
     add_header 'Content-Type' 'text/plain charset=UTF-8'; 
     add_header 'Content-Length' 0; 
     return 204; 
    } 

    proxy_redirect off; 
    proxy_set_header host $host; 
    proxy_set_header X-real-ip $remote_addr; 
    proxy_set_header X-forward-for $proxy_add_x_forwarded_for; 
    proxy_pass http://127.0.0.1:3000; 
    } 
} 

或者你也可以在位置外块移动，所以每一个要求有响应

server { 
    listen 80; 
    server_name api.localhost; 

add_header 'Access-Control-Allow-Origin' 'http://api.localhost'; 
add_header 'Access-Control-Allow_Credentials' 'true'; 
add_header 'Access-Control-Allow-Headers' 'Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range'; 
add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS,PUT,DELETE,PATCH'; 

    location/{ 

    if ($request_method = 'OPTIONS') { 
     add_header 'Access-Control-Max-Age' 1728000; 
     add_header 'Content-Type' 'text/plain charset=UTF-8'; 
     add_header 'Content-Length' 0; 
     return 204; 
    } 

    proxy_redirect off; 
    proxy_set_header host $host; 
    proxy_set_header X-real-ip $remote_addr; 
    proxy_set_header X-forward-for $proxy_add_x_forwarded_for; 
    proxy_pass http://127.0.0.1:3000; 
    } 
} 

如果只想允许在你的配置为CORS某些位置。像/api那么你应该创建一个模板的conf您的标题

add_header 'Access-Control-Allow-Origin' 'http://api.localhost'; 
add_header 'Access-Control-Allow_Credentials' 'true'; 
add_header 'Access-Control-Allow-Headers' 'Authorization,Accept,Origin,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range'; 
add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS,PUT,DELETE,PATCH'; 

，然后在OPTIONS块/api块使用

include conf.d/corsheaders.conf; 

。所以CORS只允许/api。如果你不关心CORS的位置，那么你可以使用第二种方法将核心标题移动到服务器块