$http post 请求未添加指定的标头

Posted 2023-02-27

【中文标题】$http post 请求未添加指定的标头

【英文标题】：$http post request is not adding specified headers

【发布时间】：2017-06-22 10:01:51

【问题描述】：

我正在使用 $http 向我的服务器发出请求以登录我的后端，但即使在正确指定标头之后，它也会预先发送我的请求并添加我从未问过的标头。

这是我向服务器发出的请求

$http(
       method: 'POST',
       url: 'http://localhost:8080/SignInMainServlet',
       data: $httpParamSerializerJQLike(
                login_source: source,
                accessToken: code,
                referrer_code: referral_id
            ),
       headers:  'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8' 
     );

这是我处理请求的服务器代码

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException 
    // TODO Auto-generated method stub
    REFERRAL_CODE_COUNT++;
    String referrer_code=request.getParameter("referrer_code");
    String login_source=request.getParameter("login_source");
    String accessToken=request.getParameter("accessToken");

    SignInMainManager m = new SignInMainManager(accessToken, referrer_code, login_source,REFERRAL_CODE_COUNT);
    String result = m.signIn();


    response.setContentType("text/html");  

    response.addHeader("Access-Control-Allow-Origin","*");
    response.addHeader("Access-Control-Allow-Methods","POST");
    response.addHeader("Access-Control-Allow-Headers","Content-Type");

    PrintWriter out = response.getWriter(); 


    out.println(result);
    out.close();//closing the stream 

这是浏览器控制台显示的错误

XMLHttpRequest cannot load http://localhost:8080/SignInMainServlet. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access.

这就是 xhr 调用在 chrome 上的请求、响应和一般情况

// Request//
OPTIONS /SignInMainServlet HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Access-Control-Request-Method: POST
Origin: http://localhost:3000
User-Agent: Mozilla/5.0 (Linux; android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Mobile Safari/537.36
Access-Control-Request-Headers: authorization
Accept: */*
Referer: http://localhost:3000/
Accept-Encoding: gzip, deflate, sdch, br
Accept-Language: en-GB,en-US;q=0.8,en;q=0.6

//Response//
HTTP/1.1 200 OK
Date: Sun, 05 Feb 2017 10:44:57 GMT
Allow: POST, TRACE, OPTIONS
Content-Length: 0
Server: Jetty(8.1.14.v20131031)

//General//
Request URL:http://localhost:8080/SignInMainServlet
Request Method:OPTIONS
Status Code:200 OK
Remote Address:127.0.0.1:8080

卡在这里一天。真的需要帮助！！

【参考方案1】：

我看到你正在使用authentification。我相信您的预检请求不起作用，因为您错过了 CORS 中的一些配置。这样，您的预检请求就会中止。像这样设置你的 CORS：

response.addHeader("Access-Control-Allow-Origin","*");
response.addHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS");
response.addHeader("Access-Control-Allow-Credentials", "true");
response.addHeader("Access-Control-Allow-Headers","Origin, Content-Type, X-Auth-Token , Authorization");

最重要的是您只配置了一个protected void doPost() 监听器。这样，预检 OPTIONS 请求没有配置 CORS，因为它正在侦听 doOptions()。添加一个doOptions() 侦听器并将您的CORS 配置放入其中或在全球范围内定义您的response CORS。

这样想：

protected void doOptions(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException 

    response.addHeader("Access-Control-Allow-Origin","*");
    response.addHeader("Access-Control-Allow-Methods","GET, POST, OPTIONS");
    response.addHeader("Access-Control-Allow-Credentials", "true");
    response.addHeader("Access-Control-Allow-Headers","Origin, Content-Type, X-Auth-Token , Authorization");

    PrintWriter out = response.getWriter();
    out.close();//closing the stream

【讨论】：

为什么我的请求中出现“Access-Control-Request-Headers：授权”，即使我似乎从未在任何地方应用过它？

它显示在您的回复/请求Access-Control-Request-Headers: authorization 中。这是请求头还是响应头？

但我从来没有自己添加过

请求头

嗯，这可能取决于您的客户端应用程序中的标头配置，或者您的客户端（浏览器）正在操作标头。此 CORS 设置是否适合您？