OPTIONS 预检请求在 https 上收到 400 个错误请求

Question

我在前端有 Ajax 调用，我正在通过 ajax 调用调用 WCF 服务，但是 ajax 调用有一些添加标头，这就是为什么第一次预检 OPTIONS 请求被引发并且由于“url”而下降的原因已被 cors 政策阻止。

我已经在我的 web.config 文件中添加了下面的代码，但它仍然可以工作。

<system.webServer>
        <security>
            <requestFiltering>
                <verbs>
                    <add verb="OPTIONS" allowed="true" />
                    <add verb="POST" allowed="true" />
                    <add verb="GET" allowed="true" />
                    <add verb="DELETE" allowed="false" />
                </verbs>
            </requestFiltering>
        </security>
        <httpProtocol>
            <customHeaders>
                <remove name="X-Powered-By" />
                <add name="Access-Control-Allow-Credentials" value="true" />
                <add name="Access-Control-Allow-Origin" value="*" />
                <add name="Access-Control-Allow-Methods" value="GET,POST,DELETE,OPTIONS" />
                <add name="Access-Control-Allow-Headers" value="accept, cache-control, content-type, authorization, context" />
            </customHeaders>
        </httpProtocol>
    </system.webServer>


$.ajax({
                async: true,
                type: "POST",
                headers: {
                    'Authorization': 'Basic ' + btoa(BasicAuth),
                    'Context': 'Context' + btoa(ContextHeader)
                },
                contentType: "application/json; charset=utf-8",
                data: '{"Id": "' + Id + '" }',
                url: URL + "/MethodName",
                success: function (result) {
                    response = result;
                    if (response == true)
                        Xrm.Page.data.refresh(true);
                    $('#msgDiv').fadeOut('slow');
                },
                error: function (status) {
                    console.log(status.status);
                    $('#msgDiv').fadeOut('slow');
                    Configurations.OnFailure(status);
                }
            });

上面是我用javascript写的代码。

在 HTTP 上调用它工作正常。但在 HTTPS 上调用它不工作。

我在控制台上收到如下错误

enter code here

• OPTIONS https://abc/xyz 400（错误请求）

• 从源 'https://Localhost' 访问 XMLHttpRequest 在 'https://abc/xyz' 已被 CORS 策略阻止：对预检请求的响应未通过访问控制检查：它没有 HTTP ok 状态

Answer 1

这是我的 CORS 解决方案，希望对您有用。将全局应用程序类添加到我的 wcf 服务应用程序。
Global.asax

protected void Application_BeginRequest(object sender, EventArgs e)
        {
            HttpContext.Current.Response.AddHeader("Access-Control-Allow-Origin", "*");
            if (HttpContext.Current.Request.HttpMethod == "OPTIONS")
            {
                HttpContext.Current.Response.AddHeader("Cache-Control", "no-cache");
                HttpContext.Current.Response.AddHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
                HttpContext.Current.Response.AddHeader("Access-Control-Allow-Headers", "Cache-Control, Pragma, Origin, Authorization, Content-Type, X-Requested-With,Accept");
                HttpContext.Current.Response.AddHeader("Access-Control-Max-Age", "1728000");
                HttpContext.Current.Response.End();
            }
        }

服务器上的 web.config

  <system.serviceModel>
    <bindings>
      <webHttpBinding>
        <binding name="mybinding">
          <security mode="Transport">
            <transport clientCredentialType="Basic" proxyCredentialType="Basic"></transport>
          </security>
        </binding>
      </webHttpBinding>
    </bindings>
    <behaviors>
      <serviceBehaviors>
        <behavior>
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
          <serviceDebug includeExceptionDetailInFaults="true"/>
          <dataContractSerializer maxItemsInObjectGraph="2147483647"/>
        </behavior>
      </serviceBehaviors>
      <endpointBehaviors>
        <behavior>
          <webHttp />
        </behavior>
      </endpointBehaviors>
    </behaviors>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true">
    </serviceHostingEnvironment>
    <protocolMapping>
      <add scheme="https" binding="webHttpBinding" bindingConfiguration="mybinding"/>
      <add scheme="http" binding="webHttpBinding" />
    </protocolMapping>
  </system.serviceModel>

然后在客户端（我们运行JS的地方）安装服务器服务证书。

JS.

<script>
        function make_base_auth(user, password) {
            var tok = user + ':' + password;
            var hash = window.btoa(tok); //javascript built-in function
            return "Basic " + hash;
        }
        $(function () {
            $.ajax({
                type: "GET",
                url: "https://vabqia130vm:12001/service1.svc/getdata?value=34",
                contentType: "application/json;charset=utf-8",
                beforeSend: function (req) {
                    req.setRequestHeader("Authorization", make_base_auth("administrator",
                        "abcde12345!"));
                },
                success: function (d) {
                    console.log(d);
                },

            });

        })
    </script>

结果。

如果有什么可以帮助的，请随时告诉我。

Answer 2

我在服务端创建了 dispatchmessageInspector 来在调用实际服务之前检查身份验证是否正确。

以下代码是我为处理调度检查员的身份验证而编写的。

public object AfterReceiveRequest(ref Message request, IClientChannel channel, InstanceContext instanceContext)
        {
            var logFileName = SetLogInfo("JavaScriptBasicAuth");
            try
            {
                if (!HttpContext.Current.Request.HttpMethod.Equals("OPTIONS"))
                {
                    var basicAuth = HttpContext.Current.Request.Headers["Authorization"];
                    if (basicAuth != null)
                    {
                        string[] separator = basicAuth.Split(' ');
                        BasicAuthenticationBehaviorAttribute basicauth = new BasicAuthenticationBehaviorAttribute();
                        if (!basicauth.ValidateBasicAuth(separator[1]))
                        {
                            throw new WebFaultException(HttpStatusCode.Unauthorized);
                        }
                    }
                    else
                    {
                        FileLogger.LogError("401 (Unauthorized) Error - " + "You are not authorized to perform this operation. Please contact administrator.", LOG_SUB_DIRECTORY, logFileName);
                        throw new WebFaultException(HttpStatusCode.Unauthorized);
                    }
            }
        }

但调用在 Dispatcher 检查器代码之前失败。