英文:
CORS Authorization polymer and goapp golang
问题
我有一个与goapp服务器交互的聚合前端。只要我不在头部传递授权令牌，一切都正常。以下是Polymer端的代码：
<iron-ajaxautourl="http://localhost:8080/ephomenotes"handle-as="json"last-response="{{response}}"headers="[[_computeHeader()]]"debounce-duration="300"></iron-ajax>_computeHeader() {var token = localStorage.getItem("savedToken");var obj = {};obj.Authorization = "Bearer " + token;return obj;//return {"Authorization": "Bearer " + token};}
在Go服务器端：
w.Header().Set("Access-Control-Allow-Credentials", "true")if origin := r.Header.Get("Origin"); origin != "" {w.Header().Set("Access-Control-Allow-Origin", origin)}w.Header().Set("Access-Control-Allow-Headers", "Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization")if r.Method == "OPTIONS" {return}
请注意，如果我从Polymer代码中删除headers="[[_computeHeader()]]"，那么它可以正常工作。但是使用授权令牌时，它会抛出以下错误：
XMLHttpRequest无法加载http://localhost:8080/ephomenotes。预检请求的响应未通过访问控制检查：所请求的资源上没有'Access-Control-Allow-Origin'头。因此，不允许访问来源'http://localhost:8081'。
请帮忙解决。
英文:
I have polymer frontend which interact with goapp server. Everything works fine as long as I do not pass authorization token in header. Here is the code at Polymer side
<iron-ajaxautourl="http://localhost:8080/ephomenotes"handle-as="json"last-response="{{response}}"headers="[[_computeHeader()]]"debounce-duration="300"></iron-ajax>_computeHeader() {var token = localStorage.getItem("savedToken");var obj = {};obj.Authorization = "Bearer " + token;return obj;//return {"Authorization": "Bearer " + token};}
At golang server side
w.Header().Set("Access-Control-Allow-Credentials", "true")if origin := r.Header.Get("Origin"); origin != "" {w.Header().Set("Access-Control-Allow-Origin", origin)}w.Header().Set("Access-Control-Allow-Headers", "Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization")if r.Method == "OPTIONS" {return}
Please note is I remove headers="[[_computeHeader()]]" from polymer code then it works..However with Authorization token it throws following error.
> XMLHttpRequest cannot load http://localhost:8080/ephomenotes. Response
> to preflight request doesn't pass access control check: No
> 'Access-Control-Allow-Origin' header is present on the requested
> resource. Origin 'http://localhost:8081' is therefore not allowed
> access.
Please help
答案1
得分: 2
解决了问题..
为选项创建了新的路由
r.OPTIONS("/ephomenotes", optionsheader)r.GET("/ephomenotes", env.EPHomePage)
这是新的函数。
func optionsheader(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {w.Header().Set("Access-Control-Allow-Credentials", "true")if origin := r.Header.Get("Origin"); origin != "" {w.Header().Set("Access-Control-Allow-Origin", origin)}w.Header().Set("Access-Control-Allow-Headers", "Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization")// w.Header().Set("Access-Control-Allow-Methods", "POST, GET, OPTIONS, PUT, DELETE")}
但是我不确定为什么这个方法有效？
英文:
Resolved the issue ..
created new route for options
r.OPTIONS("/ephomenotes", optionsheader)r.GET("/ephomenotes", env.EPHomePage)
This is the new function.
func optionsheader(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {w.Header().Set("Access-Control-Allow-Credentials", "true")if origin := r.Header.Get("Origin"); origin != "" {w.Header().Set("Access-Control-Allow-Origin", origin)}w.Header().Set("Access-Control-Allow-Headers", "Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization")// w.Header().Set("Access-Control-Allow-Methods", "POST, GET, OPTIONS, PUT, DELETE")}
However I am not sure, why this one worked?
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论