响应中的 CORS 策略 Access-Control-Allow-Origin 标头不能是通配符 * 当凭据包括时答案

【问题标题】：CORS policy Access-Control-Allow-Origin header in the response mustn't be wildcard * when credentials include响应中的 CORS 策略 Access-Control-Allow-Origin 标头不能是通配符 * 当凭据包括时
【发布时间】：2020-06-29 18:41:13
【问题描述】：

我是一名初级开发人员，这是我第一次在 Heroku 上部署 Rails API 和 React-Redux 前端应用程序，我的后端使用会话 cookie 进行用户身份验证，我的前端使用 credentials: "include" 发送请求不通过 CORS 政策。我尝试了很多教程，但没有一个修复了我的错误。这是错误和代码

错误

Access to fetch at 'https://lets-kari-to-the-next.herokuapp.com/api/v1/session/status' from origin 'https://lets-meetup-app.herokuapp.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.

config.ru

 use Rack::Cors do
 allow do
   origins '*'
   resource '*',
       :headers => :any,
       :methods => [:get, :post, :delete, :put, :patch, :options]
 end
end

React-Redux 获取方法

import { LOGGED_IN, LOGGED_OUT, BASE_URL } from "./types"


export const sessionStatus = () => {
    return dispatch => {
        return fetch(`${BASE_URL}/api/v1/session/status`, {
            headers: {
                "Content-Type": "application/json",
                "Accept": "application/json",
                "Allow-Control-Allow-Origin": 'https://lets-meetup-app.herokuapp.com',
                "Access-Control-Allow-Credentials": "true"
            },
            credentials: "include",
        })
            .then(resp => resp.json())
            .then(data => {
                data.logged_in ? dispatch({ type: LOGGED_IN, user: data.user.data.attributes, interests: data.interests }) : dispatch({ type: LOGGED_OUT, payload: data })
            })
    }
}

【问题讨论】：

标签： javascript ruby-on-rails-6

【解决方案1】：

在您的 gem 文件中添加 gem 'rack-cors' 和 bundle install。

在你的application.rb中添加下面的sn-p

config.middleware.insert_before 0, Rack::Cors do
      allow do
        origins '*'
        resource '*', 
          headers: :any, 
          expose: ['access-token', 'expiry', 'token-type', 'uid', 'client'],
          methods: [:get, :post, :options, :delete, :put]
      end
    end

【讨论】：

感谢您的回答@Thananjaya S，但在 config.ru 中添加凭据：true 解决了问题！我也会尝试你的解决方案。

【解决方案2】：

在config.ru 中添加credentials: true 并在origins 中指定域地址修复了问题

use Rack::Cors do
 allow do
   origins 'https://lets-meetup-app.herokuapp.com'
   resource '*',
       :headers => :any,
       :methods => [:get, :post, :delete, :put, :patch, :options],
       credentials: true
 end
end

import { LOGGED_IN, LOGGED_OUT, BASE_URL } from "./types"


export const sessionStatus = () => {
    return dispatch => {
        return fetch(`${BASE_URL}/api/v1/session/status`, {
            headers: {
                "Content-Type": "application/json",
                "Accept": "application/json"
            },
            credentials: "include",
        })
            .then(resp => resp.json())
            .then(data => {
                data.logged_in ? dispatch({ type: LOGGED_IN, user: data.user.data.attributes, interests: data.interests }) : dispatch({ type: LOGGED_OUT, payload: data })
            })
    }
}

【讨论】：