XMLHttpRequest：网络错误访问被拒绝

Posted 2023-03-04

【中文标题】XMLHttpRequest：网络错误访问被拒绝

【英文标题】：XMLHttpRequest: Network Error Access is denied

【发布时间】：2015-01-31 14:10:04

【问题描述】：

我有一个 MVC 4 应用程序使用 Angular 向 Web API 应用程序发出 http POSTS 请求。在开发环境中一切正常，但是当部署到我们的生产环境时，我在浏览器的控制台日志中收到以下错误

XMLHttpRequest: Network Error 0x80070005, Access is denied.

这看起来像是 CORS 问题，我在 web.config 中添加了以下代码

<system.webServer>
<handlers>
  <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
  <remove name="OPTIONSVerbHandler" />
  <remove name="TRACEVerbHandler" />
  <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
<httpProtocol>
  <customHeaders>
    <clear />
    <add name="Access-Control-Allow-Origin" value="*" />
    <add name="Access-Control-Allow-Methods" value="GET, PUT, POST, DELETE, HEAD, OPTIONS" />
    <add name="Access-Control-Allow-Headers" value="Origin, X-Requested-With, Content-Type, Accept" />
  </customHeaders>
</httpProtocol>

并关注Enabling Cross-Origin Requests in ASP.NET Web API 2 无济于事。我还有什么遗漏的吗？

【参考方案1】：

好的，我从 web.config 中删除了以下代码

<httpProtocol>
  <customHeaders>
   <clear />
    <add name="Access-Control-Allow-Origin" value="*" />
    <add name="Access-Control-Allow-Methods" value="GET, PUT, POST, DELETE, HEAD, OPTIONS" />
    <add name="Access-Control-Allow-Headers" value="Origin, X-Requested-With, Content-Type, Accept" />
  </customHeaders>
</httpProtocol>

并为我的 web api 编写了一个自定义 CORS 策略属性类

[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, AllowMultiple = false)]
public class CrestCorsPolicyAttribute : Attribute, ICorsPolicyProvider 

    private readonly CorsPolicy _policy;

    public CrestCorsPolicyAttribute()
    
        _policy = new CorsPolicy
        
            AllowAnyMethod = true,
            AllowAnyHeader = true
        ;

        var allowedOrigins = ConfigurationManager.AppSettings["AllowedOrigins"].Split(',');
        foreach (var allowedOrigin in allowedOrigins)
        
            _policy.Origins.Add(allowedOrigin);
        
    

    public Task<CorsPolicy> GetCorsPolicyAsync
        (
        HttpRequestMessage request, 
        CancellationToken cancellationToken
        )
    
        return Task.FromResult(_policy);
    

我从我的 Global.asax 文件中实现的

GlobalConfiguration.Configuration.EnableCors(new CrestCorsPolicyAttribute());