我正在构建一个非常小的google chrome扩展来打开我在spotify上收听的歌曲的歌词页面。我成功地从spotify获得了歌曲数据，我可以向genius验证用户身份，但是当我搜索歌曲时，请求在飞行前失败。
Genius正在响应{"meta":{"status":403,"message":"Action forbidden for current scope"}}，Chrome正在控制台上打印此消息：Response for preflight has invalid HTTP status code 403。
尽管Genius似乎责怪令牌的作用域，但我尝试使用所有作用域（me、create_annotation、manage_annotation和vote）进行身份验证，问题仍然存在。而且，同一请求对使用同一令牌的邮递员也很有效。
我的代码如下：
let xhttp = new XMLHttpRequest();
xhttp.open("GET", "https://api.genius.com/search?q=Paranoid", true);
xhttp.setRequestHeader("Authorization", "Bearer " + accessToken);
xhttp.send();
完整的请求：
General
Request URL:https://api.genius.com/search?q=Paranoid
Request Method:OPTIONS
Status Code:403
Remote Address:104.16.213.100:443
Referrer Policy:no-referrer-when-downgrade
Request Headers
:authority:api.genius.com
:method:OPTIONS
:path:/search?q=Paranoid
:scheme:https
accept:*/*
accept-encoding:gzip, deflate, br
accept-language:pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7
access-control-request-headers:authorization
access-control-request-method:GET
origin:chrome-extension://ppkhnbipegikhcenmfgpajgphcdkgdej
user-agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
Response Headers
access-control-allow-headers:Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Content-Type, Accept, X-Auth-Token, Authorization
access-control-allow-methods:GET, PUT, POST, OPTIONS, DELETE
access-control-allow-origin:*
cache-control:no-cache
cf-ray:3e3dc4d51f888138-GRU
content-encoding:gzip
content-type:application/json; charset=utf-8
date:Sat, 27 Jan 2018 18:27:56 GMT
expect-ct:max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server:cloudflare
set-cookie:__cfduid=db59a3c93b09d3f7b0907ed395ceb1b341517077676; expires=Sun, 27-Jan-19 18:27:56 GMT; path=/; domain=.genius.com; HttpOnly
status:403
status:403 Forbidden
via:1.1 vegur
x-runtime:11
Genius API，供参考：Genius
最佳答案
我在React上做了类似的事情，得到了同样的错误，因为我在网上找不到答案，对我来说唯一有效的方法是：不是对URL做一个请求并单独发送用于身份验证的头（正如文档中建议的那样），而是将访问令牌作为一个查询字符串发送（不发送标题）例如：https://api.genius.com/search?q=Paranoid&access_token=YOUR_ACCESS_TOKEN