Nginx WebDAV 模块忽略 CORS 标头
Posted
技术标签:
【中文标题】Nginx WebDAV 模块忽略 CORS 标头【英文标题】:Nginx WebDAV module ignoring CORS headers 【发布时间】:2019-02-04 20:31:26 【问题描述】:我正在使用 nginx 运行 WebDAV。我有一个 JS 应用程序将其用作存储。问题是 WebDAV 扩展正在删除我在配置中使用“add_header”添加的标头。
server
# IP, Certificates, fullpath, autoindex ...
dav_methods PUT DELETE MKCOL COPY MOVE;
dav_ext_methods PROPFIND OPTIONS;
dav_access user:rw group:rw all:rw;
location /
root /srv/http/content;
# Preflighted requests
if ($request_method = OPTIONS)
add_header "Access-Control-Allow-Origin" *;
add_header "Access-Control-Allow-Methods" "GET, HEAD, POST, PUT, OPTIONS, MOVE, DELETE, COPY, LOCK, UNLOCK, PROPFIND";
add_header "Access-Control-Allow-Headers" "Authorization, Origin, X-Requested-With, Content-Type, Accept, DNT, X-CustomHeader, Keep-Alive,User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Range, Range, Depth";
return 200;
if ($request_method = (GET|POST|HEAD|DELETE|PROPFIND))
add_header "Access-Control-Allow-Origin" *;
add_header "Access-Control-Allow-Methods" "GET, HEAD, POST, PUT, OPTIONS, MOVE, DELETE, COPY, LOCK, UNLOCK, PROPFIND";
add_header "Access-Control-Allow-Headers" "Authorization, Origin, X-Requested-With, Content-Type, Accept";
当我从我的应用程序打开 WebDAV 连接时,它会请求 OPTIONS
,然后是 PROPFIND
。请求 OPTIONS
通过正确的 CORS 标头传递,但 PROPFIND
失败,因为没有设置 CORS 标头。
请注意配置中OPTIONS
的特殊情况,我强制Nginx 返回Http200
。然后出现标题。但是当让 WebDAV 完成时,所有 CORS 标头都会消失。
有人规避了这种行为吗?
【问题讨论】:
【参考方案1】:我遇到了同样的问题。
尝试将always
关键字添加到add_header
语句:
add_header "Access-Control-Allow-Origin" * always;
add_header "Access-Control-Allow-Methods" "GET, HEAD, POST, PUT, OPTIONS, MOVE, DELETE, COPY, LOCK, UNLOCK, PROPFIND" always;
add_header "Access-Control-Allow-Headers" "Authorization, Origin, X-Requested-With, Content-Type, Accept, DNT, X-CustomHeader, Keep-Alive,User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Range, Range, Depth" always;
add_header 文档:
语法:add_header name value [always];
将指定字段添加到响应标头,前提是 响应码等于 200, 201 (1.3.10), 204, 206, 301, 302, 303, 304, 307(1.1.16、1.0.13)或 308(1.13.0)。 [...] 如果总是参数 已指定(1.7.5),将添加标题字段,而不管 响应代码。
https://nginx.org/en/docs/http/ngx_http_headers_module.html
【讨论】:
【参考方案2】:其实是 nginx 的 webdav 的一个 bug。我能够使用 lighttpd 快速运行 webdav(带有 CORS、身份验证和 SSL)。我的示例配置
server.port = 81
server.username = "http"
server.groupname = "http"
server.modules = (
"mod_webdav",
"mod_auth",
"mod_setenv", # before mod_status, very important!
"mod_status",
"mod_openssl"
)
server.document-root= "/srv/http/content"
server.errorlog = "/var/log/lighttpd/error.log"
ssl.engine = "enable"
ssl.pemfile = "/etc/ssl/webdav.key"
webdav.activate = "enable"
auth.backend = "htpasswd"
auth.backend.htpasswd.userfile = "/srv/http/passwd"
setenv.add-response-header = (
"Access-Control-Allow-Origin" => "*",
"Access-Control-Allow-Methods" => "GET, HEAD, POST, PUT, OPTIONS, MOVE, DELETE, COPY, LOCK, UNLOCK, PROPFIND",
"Access-Control-Allow-Headers" => "Authorization, Origin, X-Requested-With, Content-Type, Accept, DNT, X-CustomHeader, Keep-Alive,User-Agent, X-Requested-With, If-Modified-Since,Cache-Control, Content-Range, Range, Depth, Content-Length"
)
mimetype.assign = (
".html" => "text/html",
".txt" => "text/plain",
".css" => "text/css",
".js" => "application/x-javascript",
".jpg" => "image/jpeg",
".jpeg" => "image/jpeg",
".gif" => "image/gif",
".png" => "image/png",
"" => "application/octet-stream"
)
【讨论】:
以上是关于Nginx WebDAV 模块忽略 CORS 标头的主要内容,如果未能解决你的问题,请参考以下文章
django-cors-headers 和 nginx 配置:预检响应缺少 CORS 标头
nginx实战 WebDAV 模块 http_dav_module
Spring Boot Cors“Access-Control-Max-Age”标头被浏览器忽略
调用 AWS Lambda 时,Chrome 忽略 Access-Control-Allow-Origin 标头并因预检错误导致 CORS 失败