Express 服务器不回复正确的 cors 标头答案

【问题标题】：Express server does not reply with proper cors headersExpress 服务器不回复正确的 cors 标头
【发布时间】：2019-02-26 23:46:40
【问题描述】：

我希望 Allow-Access-Control 标头出现在响应标头中，但我什么也没得到。我相当确定这不是我的 nginx 配置，而是我的 express 配置，但是我已经调整并将 cors 标头添加到所有可用的响应变量中。

const path = require('path');
var cors = require('cors');
var express = require('express');
var app = express();
var walk = require('walk');
var ALLfiles = [];



app.use(function(req, res, next) {
  res.header("Access-Control-Allow-Origin", "*");
  res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
  next();
});
app.use("/puntington", express.static("/puntington"));

app.get('/puntington', function(req, res) {

  //EDIT: If you need to go under subdirs: change glob to walk as said in https://stackoverflow.com/questions/2727167/getting-all-filenames-in-a-directory-with-node-js/25580289#25580289
  var walker = walk.walk('./puntington', {
    followLinks: false
  });
  walker.on('file', function(root, stat, next) {
    // Add this file to the list of files
    ALLfiles.push(path.join("https://static.maxrobbins.com/images/listPuntyImages/puntington", stat.name));
    next();
  });

  walker.on('end', function() {
    res.header("Access-Control-Allow-Origin", "*");
    res.header('Access-Control-Allow-Methods', 'DELETE, PUT, GET, POST');
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    res.send(ALLfiles);
  });

});

var server = app.listen(8666, function() {

  var host = server.address().address;
  var port = server.address().port;

  console.log('Example app listening at http://%s:%s', host, port);

});

来自服务器的响应标头

Connection  
keep-alive
Content-Length  
169
Content-Type    
text/html
Date    
Sun, 23 Sep 2018 03:29:29 GMT
Server  
nginx/1.15.3

nginx服务器配置

 location /puntington {
#     auth_basic "Restricted Content";
#     auth_basic_user_file /etc/nginx/sites-available/.htpasswd;
     proxy_set_header   X-Real-IP $remote_addr;
     proxy_set_header   Host      $http_host;
     proxy_set_header X-Forwarded-Proto $scheme;
     proxy_pass         http://127.0.0.1:8666/puntington;
     proxy_redirect off;



#     auth_basic "Restricted Content";
#     auth_basic_user_file /etc/nginx/sites-available/.htpasswd;
     if ($request_method = 'OPTIONS') {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain; charset=utf-8';
        add_header 'Content-Length' 0;
        return 204;
     }
     if ($request_method = 'POST') {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
        add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
     }
     if ($request_method = 'GET') {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
        add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
     }
 }

【问题讨论】：

在 nginx 层之外尝试会发生什么？
我现在在 Windows 中，所以无法测试。我假设同样的事情？我们是否建议您摆脱 ngi x？我需要它来处理其他服务的反向代理
响应的 HTTP 状态码是什么？
你 var cors = require('cors'); 永远不要使用 cors！您只需尝试手动操作！ - 也许您的（未显示）客户端代码正在触发 CORS 飞行前 - 您没有处理
你是对的。如果我这样做， $.ajax({ url: 'localhost:8666/puntington', success: function(data) { console.log(data)} }) 它工作正常，但如果我点击 nginx 端点它会触发 CORS。为什么？

标签： javascript node.js express nginx cors

【解决方案1】：

我想通了。因为我在 nginx 和 express 中都设置了 CORS 标头，所以浏览器本身变得混乱和大便，我的意思是我在响应标头中获得了重复的 CORS 设置。通过从 nginx 站点配置中删除 CORS 标头并仅使用快速设置，一切正常。我感谢帮助男孩

【讨论】：