EnableCors始终为Web Api中的允许来源返回通配符(EnableCors always return wildcard for allowed origins in Web Api)

编程入门行业动态更新时间:2024-10-27 14:18:44

我有一个方案是从http发送ajax post请求到https（出于某些复杂的原因必须这样做），我需要为了cookie而传递凭据。

我在服务器端使用Web Api，使用NuGet包Microsoft.AspNet.WebApi.Cors来启用Cors请求。

客户端的代码：

$.ajax({ url: 'https://www.sitename.com/api/xxx', type: 'post', data: { '': 1 }, headers: { '__AntiXsrfTokenKey': 'whatevertokenhere' }, xhrFields: { withCredentials: true }, dataType: 'json', success: function (data) { } });

Web Api设置：

config.EnableCors();

控制器的EnableCors属性：

[EnableCors(origins: "http://www.sitename.com", headers: "*", methods: "*", SupportsCredentials = true)] public class XXXController : ApiController

预检请求标题：

Access-Control-Request-Headers: accept, __AntiXsrfTokenKey, content-type Access-Control-Request-Method: POST Origin: http://www.sitename.com

响应头：

Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: __AntiXsrfTokenKey,content-type Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Access-Control-Allow-Origin: *

问题很明显，Access-Control-Allow-Origin标头返回一个通配符*，而不是我在控制器' http://www.sitename.com '的属性中指定的请求源。所以我最终得到了错误：

A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin 'http://www.sitename.com' is therefore not allowed access.

有没有人知道为什么这种行为以及如何在EnableCors属性中正确设置Access-Control-Allow-Origin域？

I have one scenario to send an ajax post request from http to https (have to do that for some complex reasons), and I need to pass credentials for the sake of cookies.

I use Web Api in server side, with NuGet package Microsoft.AspNet.WebApi.Cors to enable Cors request.

The code in client side:

Web Api settings:

config.EnableCors();

EnableCors attribute for controller:

[EnableCors(origins: "http://www.sitename.com", headers: "*", methods: "*", SupportsCredentials = true)] public class XXXController : ApiController

The preflight request header:

Access-Control-Request-Headers: accept, __AntiXsrfTokenKey, content-type Access-Control-Request-Method: POST Origin: http://www.sitename.com

The response header:

Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: __AntiXsrfTokenKey,content-type Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Access-Control-Allow-Origin: *

The problem is clearly that Access-Control-Allow-Origin header is returning a wildcard *, instead of the request origin which I specified in the attribute of the controller 'http://www.sitename.com'. So I end up of the error:

A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin 'http://www.sitename.com' is therefore not allowed access.

Does any one know why is that behavior and how I can set the Access-Control-Allow-Origin domain correctly in the EnableCors attribute?