cors 策略错误：对预检请求的响应未通过访问控制检查：没有'Access-Control-Allow-Origin

Question

我已经安装了 django-cors-headers，这是 settings.py ：

    ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS","").split()

MIDDLEWARE = [
    
    'django.middleware.security.SecurityMiddleware',
    
    'django.contrib.sessions.middleware.SessionMiddleware',
    'corsheaders.middleware.CorsMiddleware',
    
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.auth.middleware.RemoteUserMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

还有：

    CORS_ALLOW_ALL_ORIGINS = True  
CORS_ALLOW_CREDENTIALS = True

但我在 chrome consloe 中收到此错误：

Access to XMLHttpRequest at 'https://event-alpha.mizbans.com/api/meetings/?memory=0' from origin 'https://alpha.mizbans.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Answer 1

我遇到了类似的问题，都是关于 CORS_ALLOW_ALL_ORIGINS。事实证明，它不适用于其他东西（抱歉，不记得什么了，也许是身份验证）。所以我不得不添加特定的起源。这是我的整个设置：

# CORS SETUP
CORS_ALLOW_CREDENTIALS = True
CORS_ALLOWED_ORIGINS = [
    'http://localhost:4200',
    'http://127.0.0.1:4200'
]

CSRF_COOKIE_HTTPONLY = True
SESSION_COOKIE_HTTPONLY = True

SESSION_COOKIE_SAMESITE = 'None'
CSRF_COOKIE_SAMESITE = 'None'

对我来说，现在可以使用这种组合。