用于启用 CORS 的 Nginx 配置

Question

我正在关注参考试图让我的 nginx 接受 CORS。 http://enable-cors.org/server_nginx.html

但无论我如何配置我的 /etc/nginx/site-enable/default 如下。 它只是行不通。我的配置有什么问题吗？

谢谢。

> >

服务器{ 听 80 default_server; 听 [::]:80 default_server ipv6only=on;

    root /usr/share/nginx/html;
    index index.html index.htm;

    # Make site accessible from http://localhost/
    server_name localhost;
    #add_header Access-Control-Allow-Origin *; # < this is the needed header

    location / { 
            # First attempt to serve request as file, then
            # as directory, then fall back to displaying a 404.
            #try_files $uri $uri/ =404;
            # Uncomment to enable naxsi on this location
            # include /etc/nginx/naxsi.rules

                 if ($request_method = 'OPTIONS') {
                    add_header 'Access-Control-Allow-Origin' '*';
                    #   
                    # Om nom nom cookies
                    #   
                    add_header 'Access-Control-Allow-Credentials' 'true';
                    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
                    #   
                    # Custom headers and headers various browsers *should* be OK with but aren't
                    #   
                    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
                    #   
                    # Tell client that this pre-flight info is valid for 20 days
                    #   
                    add_header 'Access-Control-Max-Age' 1728000;
                    add_header 'Content-Type' 'text/plain charset=UTF-8';
                    add_header 'Content-Length' 0;
                    return 204;
                 }   
                 if ($request_method = 'POST') {
                    add_header 'Access-Control-Allow-Origin' '*';
                    add_header 'Access-Control-Allow-Credentials' 'true';
                    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
                    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
                 }   
                 if ($request_method = 'GET') {
                    add_header 'Access-Control-Allow-Origin' '*';
                    add_header 'Access-Control-Allow-Credentials' 'true';
                    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
                    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
                 }   
    }    }

Answer 1

仅当您在请求中发送的所有标头都在 allowed-headers 字段中传播时，才会触发 Nginx CORS 过滤器。一旦您只发送了一个本节未提及的标头，CORS-Filter 将什么也不做。你检查你的请求头了吗？

此外，您的配置不适用于 PUT 请求。您发送哪种类型的请求？您检查了响应标头吗？

尝试设置ipv6only=off;