不能在“Access-Control-Allow-Origin”中使用通配符“*”，即使它不是通配符

Question

您好，我在 PHP 和 marionette.js 中遇到了一个奇怪的错误。我有一个由 marionette.js（扩展骨干网）制成的前端，它需要对我在另一个 URL 上运行的后端 API 进行 CORS 调用。我已经覆盖了主干的同步功能以允许 withCredentials 和东西：

var proxiedSync = Backbone.sync;

  Backbone.sync = function(method, model, options) {
    options || (options = {});

    if (!options.crossDomain) {
      options.crossDomain = true;
    }

    if (!options.xhrFields) {
      options.xhrFields = {withCredentials:true};
    }

    return proxiedSync(method, model, options);
  };

在我的 Slim 3.5 后端中，我为我的 CORS 标头设置了这个中间件：

$app->add(function ($req, $res, $next) {
$response = $next($req, $res);
return $response->withHeader('Access-Control-Allow-Credentials', 'false')->withHeader('Access-Control-Allow-Origin', 'http://localhost:4000')
        ->withHeader('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type, Accept, Origin, Authorization, Session')
        ->withHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD');});

现在我在 chrome 调试工具中有当前响应：

XMLHttpRequest 无法加载 xxxx。当凭证标志为真时，不能在“Access-Control-Allow-Origin”标头中使用通配符“*”。因此，Origin 'http://localhost:4000' 不允许访问。 XMLHttpRequest 的凭据模式由 withCredentials 属性控制。

但是，当我查看“网络”选项卡并检查“请求标头”时，我可以清楚地看到 Access-Control-Allow-Origin 不是通配符，而是“http://localhost:4000”：

HTTP/1.1 200 OK
Date: Fri, 09 Sep 2016 17:35:32 GMT
Server: Apache/2.4.17 (Win64) PHP/7.0.0
X-Powered-By: PHP/7.0.0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://localhost:4000
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept, Origin, Authorization, Session
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
Content-Length: 1130
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

编辑 1：这是我的选择路线

这是我的选项路线：

$app->options('/{routes:.+}', function ($request, $response, $args) {
    return $response;
});

编辑 2：飞行前响应和请求

好的，这里是预检响应请求标头的快速更新：

OPTIONS /devsea/login HTTP/1.1
Host: localhost
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Access-Control-Request-Method: POST
Origin: http://localhost:4000
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Access-Control-Request-Headers: content-type
Accept: */*
Referer: http://localhost:4000/
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,fr;q=0.6

这是飞行前请求的响应标头：

HTTP/1.1 200 OK
Date: Fri, 16 Sep 2016 00:49:38 GMT
Server: Apache/2.4.17 (Win64) PHP/5.6.16
X-Powered-By: PHP/5.6.16
Set-Cookie: UserSession=aemsvqf9b7u2c4isdhocq4mre7; expires=Fri, 16-Sep-2016 01:49:38 GMT; Max-Age=3600; path=/
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://localhost:4000
Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept, Origin, Authorization, Session
Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, HEAD
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Answer 1

所以我知道这完全没有意义。但是在重新启动我的开发机器后，一切都开始工作了。很抱歉给大家带来了麻烦，也许 apache 需要重新启动什么的。