如何将“Access-Control-Allow-Credentials”请求标头添加到 ASP.NET 中的 POST 请求中？

Question

所以，我正在尝试使用HttpContext.Request.Headers.Add("Access-Control-Allow-Credentials", "true"); 设置“Access-Control-Allow-Credentials”，但它只适用于我的 GET 请求，但不适用于我的 POST 请求，我不知道为什么。

我也尝试在 Startup.cs 中设置它们，如下所示：

 services.AddCors(o => o.AddPolicy("ApiCorsPolicy", builder =>
            {
                builder
                       .WithOrigins("My_Web_App")
                       .AllowCredentials()
                       .AllowAnyMethod()
                       .AllowAnyHeader();
            }));

然后在Configure中使用app.UseCors("ApiCorsPolicy");

这是来自我的控制器的代码，所以我认为这里没什么特别的：

   [ApiController]
    [Route("[controller]")]
    [EnableCors("ApiCorsPolicy")]
    public class UserController : Controller
    {
        private readonly IUserService _userService;
        public UserController(IUserService userService)
        {
            _userService = userService;
        }

        [HttpPost("RegisterUser")]
        public void GetTournaments([FromBody] UserDTO user)
        {

            HttpContext.Request.Headers.Add("Access-Control-Allow-Credentials", "true");
            _userService.RegisterUser(user);
        }

    }

我的问题是，为什么我不能使用 Headers.add 方法（适用于我的 GET 请求）放置“Access-Control-Allow-Credentials”标头？如果这不是正确的方法，那么该怎么做呢？ 谢谢！

编辑： 我已按要求添加了所有启动文件：

    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

      
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddCors(o => o.AddPolicy("ApiCorsPolicy", builder =>
            {
                builder
                       .WithOrigins("http://"MyIpAddressHere"/")
                       .AllowAnyMethod()
                       .AllowAnyHeader();
            }));

            var mapperConfig = new MapperConfiguration(mc =>
            {
                mc.AddProfile(new MappingGeneral());
            });

            IMapper mapper = mapperConfig.CreateMapper();
            services.AddSingleton(mapper);

            services.AddSingleton<ITournamentService, TournamentService>();
            services.AddSingleton<IUserService, UserService>();
            services.AddControllers();
            services.AddSwaggerGen(c =>
            {
                c.SwaggerDoc("v1", new OpenApiInfo { Title = "my_app", Version = "v1" });
            });
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {

            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                app.UseSwagger();
                app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "my_app v1"));
            }

            app.UseRouting();

            app.UseCors("ApiCorsPolicy");

            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });


        }
    }

Answer 1

改变

.WithOrigins("My_Web_App")

到

.WithOrigins("http://localhost....") //your web app url

//your Url shouldn't end with "/" 

并从代码中删除：

//sometimes it interfers with token if you have
 .AllowCredentials()

// you don't need this at all
  HttpContext.Request.Headers.Add("Access-Control-Allow-Credentials", "true");

您的 UseCors 应该在 UseRouting 之后但在 UseAuthorization 之前。

并从您的控制器中删除：

 [EnableCors("ApiCorsPolicy")]

Answer 2

我高度怀疑罪魁祸首在于： https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials

不支持没有正确来源的凭据。