设置 header.Authorization 时 Laravel Cors 问题答案

【问题标题】：Laravel Cors issue when setting header.Authorization on request设置 header.Authorization 时 Laravel Cors 问题
【发布时间】：2019-09-16 15:00:06
【问题描述】：

我已经成功设置了cors中间件，使用Laravel作为描述器here

所以，这个ajax调用就ok了

        axios.get('http://my_domain/api/my_api')

但是当尝试像这样发送令牌时：

        axios.get('http://my_domain/api/my_api',
            {
              headers: {
                Authorization: 'Bearer aaa.bbb.ccc'
              }
            })

我得到一个错误提示 Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

我什至在中间件中添加了Access-Control-Allow-Headers，我仍然有问题。

<?php namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Log;

class Cors {
    public function handle($request, Closure $next) {
        Log::info("Using cors for ".$request->url());
        return $next($request)
            ->header('Access-Control-Allow-Origin', '*')
            ->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
            ->header('Access-Control-Allow-Headers', 'Authorization');
    }
}

有人可以帮忙吗？

【问题讨论】：

标签： laravel-5 authorization axios token

【解决方案1】：

我认真地试图找到解决方案，这就是我的解决方案。我必须同时添加 03 个编辑：

1) 在路由中间件中添加 cors

    protected $routeMiddleware = [
        ...
        'cors' => \App\Http\Middleware\Cors::class,
    ];

2) 在全局middlewre中添加cors

    protected $middleware = [
        ...
        \App\Http\Middleware\Cors::class,
    ];

3) 在Cors中间件app/Http/Middleware/Cors.php中添加自定义Access-Control-Allow-Headers

<?php namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Log;

class Cors {
    public function handle($request, Closure $next) {
        Log::info("Using cors for " . $request->url());
        return $next($request)
                ->header('Access-Control-Allow-Origin', '*')
                ->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
                ->header('Access-Control-Allow-Headers', 'Origin, Content-Type, Accept, Authorization, X-Request-With');// <-- Adding this
    }
}

如果有人能解释它为什么起作用，那将是很好的理解它的行为。

【讨论】：