CORS预检后的302重定向

CORS预检后的302重定向

关注
发信
关注(28)粉丝(399)

CORS预检后的302重定向

本文介绍了CORS预检后的302重定向的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

在我的CORS预检成功返回200状态后，我遇到302重定向的问题。我目前正在使用Laravel 4.1和Angular 1.2以及我自己的OAUTH2服务器构建一个应用程序。



Chrome / FF / Safari传回给我的错误是：

我假设什么造成我的问题是重定向这发生 - 作为我正常的CORS请求所有工作按预期。



我的Access-Control-Allow- *头的配置在测试期间是相当开放的。 

 'paths'=> array（
'^ / api /'=> array（
'allow_origin'=> array（'*'），
'allow_headers'=& '，'Authorization'），
'allow_methods'=> array（'POST'，'PUT'，'GET'，'DELETE'，'OPTIONS'），
'max_age'=> 0 
），
'^ / session /'=> array（
'allow_origin'=> array（'*'），
'allow_headers'=& （'Content-Type'，'Authorization'），
'allow_methods'=> array（'GET'，'OPTIONS'），
'max_age'=> 0 
）

有问题的重定向是在检查OAUTH2访问令牌有效性的预过滤器中

 公共函数过滤器（$ route，$ request，$ data = null）
 {
 //获取授权头文件或失败
 if（$ authorization = Request :: header（'Authorization'，false））{
 list（$ type，$ token）= explode（''，$ authorization）; 
 if（is_null（$ auth = OAuth2 :: token（$ token） - > first（）））{
 return Redirect :: to（'session / invalid'）; 
} 
 $ tokenExpiryDate = Carbon :: createFromTimeStamp（$ auth-> access_token_expires）; 
 
 //如果我们没有承载认证头
 //或者令牌已经过期。然后重定向到
 //过期的会话路由
 if（'bearer'！= strtolower（$ type）
 || Carbon :: now（） - > gt（$ tokenExpiryDate）
）{
 return Redirect :: route（
'expiredSession'，
 array（'expiry'=> $ tokenExpiryDate-> timestamp）
）; 
} 
} else {
 //认证头无效，重定向让用户知道。 
 return Redirect :: to（'session / invalid'）;当我尝试使用POSTMAN进行调试时，所有这些请求都工作，所有这些请求都可以正常工作。但在我的研究后，我基本上发现，扩展不一定要玩相同的规则。以及我注意到我的请求使用POSTMAN从来没有发送任何预检OPTIONS请求，当我发起一个简单的GET，POST等。
 
 
 
这里是两个OPTIONS请求以及GET请求，以返回我的错误
 
 
 
 OPTIONS请求
 
 
 
 远程地址：127.0.0.1：80 
请求URL：http：//localhost.api/api/v1/tracks？$ filter = id％20eq％20guid％27d7de10ba-e353-455b- a3cb-ced9b4965141％27& 
请求方法：OPTIONS 
状态代码：200 OK 
  
         接受：gzip，deflate，sdch 
 
 
 
 
 $ b 
  b Accept-Language：en-US，en; q = 0.8 
访问控制请求头：接受，授权
访问控制请求方法：GET 
高速缓存控制： no-cache 
连接：keep-alive 
 DNT：1 
主机：vegas.ine.com 
原因：http：//localhost.angular 
 Pragma：no -cache 
 Referer：http：//localhost.angular/admin/ 
用户代理：Mozilla / 5.0（Macintosh; Intel Mac OS X 10_9_2）AppleWebKit / 537.36（KHTML，像Gecko）Chrome / 34.0 .1847.131 Safari / 537.36 
  
 响应标题 
 访问控制允许头：内容类型，授权
访问控制允许方法：POST，PUT，GET，DELETE，选项
 Access-Control-Allow-Origin：http：//localhost.angular 
 Cache-Control：no-cache 
连接：close 
 Content-Type：text / html 
日期：Thu，2014年5月01日16:22:19 GMT 
服务器：Apache / 2.2.26（Unix）DAV / 2 PHP / 5.4.24 mod_ssl / 2.2.26 OpenSSL / 0.9.8y 
的Set-Cookie：laravel_session = eyJpdiI6IktOZjlTM1ZVNUx0TEhoaTczY3dQcDBKRWlvbnppbDA3QTdqSENJdTc2R1U9IiwidmFsdWUiOiJEZ2ltXC9mNm1Qa20rV3BVRlNHTXgySGtUeVlpNjNZcGFudDFBWDJJekl1MEVNVlhSRE5WWk5YZDNxUkZuU0VEVytcL3NLNlVBXC9hZWtJQzdHU2FqVWtMdz09IiwibWFjIjoiYTYxYjEwNjlmYmI2MjMwNmE4MzlkYjIwNGZlNzA4Y2ViZGVkZmU1MTQzMzc5NmU2YzI2ZGExNzYxY2U5ZjdiMCJ9; expires = Thu，01-May-2014 18:22:19 GMT; path = /; httponly 
 X-Frame-Options：SAMEORIGIN 
 X-Powered-By：PHP / 5.4.24 
  
 
 b $ b 
 GET请求
 
 
 
 远程地址：127.0.0.1：80 
请求URL：http： /localhost.api/api/v1/tracks?$filter=id%20eq%20guid%27d7de10ba-e353-455b-a3cb-ced9b4965141%27& 
请求方法：GET 
状态代码：302找到
  
   
 
 
 
 接受：application / json，text / plain，* / * 
 Accept-Encoding： gzip，deflate，sdch 
接受语言：en-US，en; q = 0.8 
授权：承载6Ss4XPrPM5jQD7Es0dz7TPRQ76hGA69vT9K94pst 
缓存控制：无缓存
连接：keep-alive 
 DNT：1 
主机：vegas.ine.com 
原产地：http：//localhost.angular 
 Pragma：no-cache 
 Referer：http：// localhost.angular / admin / 
 User-Agent：Mozilla / 5.0（Macintosh; Intel Mac OS X 10_9_2）AppleWebKit / 537.36（KHTML，like Gecko）Chrome / 34.0.1847.131 Safari / 537.36 
  
 
 
 
 回应标题 
 code> Access-Control-Allow-Origin：http：//localhost.angular 
 Cache-Control：no-cache 
连接：Keep-Alive 
 Content-Type：text / html; charset = UTF-8 
 Date：Thu，01 May 2014 16:22:19 GMT 
 Keep-Alive：timeout = 5，max = 100 
位置：http：//localhost.api /会话/无效
服务器：Apache / 2.2.26（Unix的）DAV / 2 PHP / 5.4.24的mod_ssl / 2.2.26的OpenSSL / 0.9.8y 
的Set-Cookie：laravel_session = eyJpdiI6InlnREVPcUJTcyswMnRLanFDSlZ6QWFBVXZWMGdMNVNLYWxNTHRJVUlkalk9IiwidmFsdWUiOiJ4aXN5U0dcL1NYeGQrcUVzWFhYV3o2MWhcL25hQTlhcVUxbWxkN2R6SG9KZDNKaGNLTkRQY2FyTitpVHNGZzYxVVRtZUhoZGZRWE9GWjZRaDd1VVwvZUZuUT09IiwibWFjIjoiY2EzZTViZGIzZmVlMDcwZjdhMzBjOWQxYTgwZWNlYTJiMDk3ODdlZTk3NTYxMDNmM2YyODJjOGIxMzBmMmJlMiJ9; expires = Thu，01-May-2014 18:22:20 GMT; path = /; httponly 
 Transfer-Encoding：chunked 
 Vary：Authorization 
 X-Clockwork-Id：1398961340.2239.1349476325 
 X-Clockwork-Version：1.5 
 X-Frame-Options ：SAMEORIGIN 
 X-Powered-By：PHP / 5.4.24 
  
 
 
解决方案
我做了这样的事情，它对我很好。
  //模式允许起源
 $ allowedOriginPattern = / **你的模式** /; 
 $ allowedOrigin =; 
 if（preg_match（$ allowedOriginPattern，$ _SERVER ['HTTP_ORIGIN']））{
 $ allowedOrigin = $ _SERVER ['HTTP_ORIGIN']; 
} 
 
 / ** 
 *设置http内容类型
 * / 
头（'Content-Type：application / json; charset = UTF- 8'）; 
 header（'Access-Control-Allow-Origin：'。$ allowedOrigin）; 
 header（'Access-Control-Allow-Methods：DELETE，HEAD，GET，OPTIONS，POST，PUT'）; 
 header（'Access-Control-Allow-Headers：Content-Type，Content-Range，Content-Disposition，Content-Description'）; 
 headers（'Access-Control-Max-Age：1728000'）; 
  
我已将此代码添加到laravel index.php 
 
 
 
这里是CORS的参考资料
  
 
I'm running into a problem with a 302 redirect after my CORS preflight has successfully returned a 200 status. I'm currently building an app using Laravel 4.1 and Angular 1.2 as well as my own OAUTH2 server. 
The error that Chrome/FF/Safari are sending back to me is:
I assume whats causing my issue is the "redirect" thats happening - as my normal CORS requests all work as expected.
My configuration for my Access-Control-Allow-* headers is fairly open right now during testing.  
  'paths' => array(
      '^/api/' => array(
          'allow_origin'=> array('*'),
          'allow_headers'=> array('Content-Type', 'Authorization'),
          'allow_methods'=> array('POST', 'PUT', 'GET', 'DELETE', 'OPTIONS'),
          'max_age' => 0
      ),
      '^/session/' => array(
          'allow_origin'=> array('*'),
          'allow_headers'=> array('Content-Type', 'Authorization'),
          'allow_methods'=> array('GET', 'OPTIONS'),
          'max_age' => 0
      )

The redirect in question is in a pre-filter thats checking the validity of an OAUTH2 access token
public function filter($route, $request, $data = null)
{
    //  Get the authorization header or fail
    if ($authorization = Request::header('Authorization', false)) {
        list($type, $token) = explode(' ', $authorization);
        if (is_null($auth = OAuth2::token($token)->first())) {
            return Redirect::to('session/invalid');
        }
        $tokenExpiryDate = Carbon::createFromTimeStamp($auth->access_token_expires);

        //  If we don't have a Bearer authentication header
        //  or if the token has expired.  Then redirect to an
        //  expired session route
        if (   'bearer' != strtolower($type)
            || Carbon::now()->gt($tokenExpiryDate)
        ) {
            return Redirect::route(
                'expiredSession',
                array('expiry' => $tokenExpiryDate->timestamp)
            );
        }
    } else {
        //  The authentication header is invalid, redirect to let the user know.
        return Redirect::to('session/invalid');
    }
}

All these requests worked when I tried debugging using POSTMAN, but after my research I've basically found that extensions don't necessarily have to play by the same rules.  As well as I noticed my requests using POSTMAN never send any preflight OPTIONS requests when I initiate a simple GET, POST, etc..
Here are the headers of both an OPTIONS request as well as a GET request to follow it that is returning my error
OPTIONS Request
Remote Address:127.0.0.1:80
Request URL:http://localhost.api/api/v1/tracks?$filter=id%20eq%20guid%27d7de10ba-e353-455b-a3cb-ced9b4965141%27&
Request Method:OPTIONS
Status Code:200 OK

Request Headers
Accept:*/*
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Access-Control-Request-Headers:accept, authorization
Access-Control-Request-Method:GET
Cache-Control:no-cache
Connection:keep-alive
DNT:1
Host:vegas.ine.com
Origin:http://localhost.angular
Pragma:no-cache
Referer:http://localhost.angular/admin/
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36

Response Headers
Access-Control-Allow-Headers:content-type, authorization
Access-Control-Allow-Methods:POST, PUT, GET, DELETE, OPTIONS
Access-Control-Allow-Origin:http://localhost.angular
Cache-Control:no-cache
Connection:close
Content-Type:text/html
Date:Thu, 01 May 2014 16:22:19 GMT
Server:Apache/2.2.26 (Unix) DAV/2 PHP/5.4.24 mod_ssl/2.2.26 OpenSSL/0.9.8y
Set-Cookie:laravel_session=eyJpdiI6IktOZjlTM1ZVNUx0TEhoaTczY3dQcDBKRWlvbnppbDA3QTdqSENJdTc2R1U9IiwidmFsdWUiOiJEZ2ltXC9mNm1Qa20rV3BVRlNHTXgySGtUeVlpNjNZcGFudDFBWDJJekl1MEVNVlhSRE5WWk5YZDNxUkZuU0VEVytcL3NLNlVBXC9hZWtJQzdHU2FqVWtMdz09IiwibWFjIjoiYTYxYjEwNjlmYmI2MjMwNmE4MzlkYjIwNGZlNzA4Y2ViZGVkZmU1MTQzMzc5NmU2YzI2ZGExNzYxY2U5ZjdiMCJ9; expires=Thu, 01-May-2014 18:22:19 GMT; path=/; httponly
X-Frame-Options:SAMEORIGIN
X-Powered-By:PHP/5.4.24

GET Request
Remote Address:127.0.0.1:80
Request URL:http://localhost.api/api/v1/tracks?$filter=id%20eq%20guid%27d7de10ba-e353-455b-a3cb-ced9b4965141%27&
Request Method:GET
Status Code:302 Found

Request Headers
Accept:application/json, text/plain, */*
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8
Authorization:Bearer 6Ss4XPrPM5jQD7Es0dz7TPRQ76hGA69vT9K94pst
Cache-Control:no-cache
Connection:keep-alive
DNT:1
Host:vegas.ine.com
Origin:http://localhost.angular
Pragma:no-cache
Referer:http://localhost.angular/admin/
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36

Response Headers
Access-Control-Allow-Origin:http://localhost.angular
Cache-Control:no-cache
Connection:Keep-Alive
Content-Type:text/html; charset=UTF-8
Date:Thu, 01 May 2014 16:22:19 GMT
Keep-Alive:timeout=5, max=100
Location:http://localhost.api/session/invalid
Server:Apache/2.2.26 (Unix) DAV/2 PHP/5.4.24 mod_ssl/2.2.26 OpenSSL/0.9.8y
Set-Cookie:laravel_session=eyJpdiI6InlnREVPcUJTcyswMnRLanFDSlZ6QWFBVXZWMGdMNVNLYWxNTHRJVUlkalk9IiwidmFsdWUiOiJ4aXN5U0dcL1NYeGQrcUVzWFhYV3o2MWhcL25hQTlhcVUxbWxkN2R6SG9KZDNKaGNLTkRQY2FyTitpVHNGZzYxVVRtZUhoZGZRWE9GWjZRaDd1VVwvZUZuUT09IiwibWFjIjoiY2EzZTViZGIzZmVlMDcwZjdhMzBjOWQxYTgwZWNlYTJiMDk3ODdlZTk3NTYxMDNmM2YyODJjOGIxMzBmMmJlMiJ9; expires=Thu, 01-May-2014 18:22:20 GMT; path=/; httponly
Transfer-Encoding:chunked
Vary:Authorization
X-Clockwork-Id:1398961340.2239.1349476325
X-Clockwork-Version:1.5
X-Frame-Options:SAMEORIGIN
X-Powered-By:PHP/5.4.24

 解决方案 
I have done something like this and it worked fine for me
//pattern to allow origins
$allowedOriginPattern = /** YOUR PATTERNS **/;
$allowedOrigin = "";
if (preg_match($allowedOriginPattern, $_SERVER['HTTP_ORIGIN'])) {
    $allowedOrigin = $_SERVER['HTTP_ORIGIN'];
}

/**
 * set http content type
 */
header('Content-Type: application/json;charset=UTF-8');
header('Access-Control-Allow-Origin: ' . $allowedOrigin);
header('Access-Control-Allow-Methods: DELETE, HEAD, GET, OPTIONS, POST, PUT');
header('Access-Control-Allow-Headers: Content-Type, Content-Range, Content-Disposition, Content-Description');
header('Access-Control-Max-Age: 1728000');

I have added this code in laravel index.php
Here is the reference for CORShttp://www.w3.org/TR/cors/#cross-origin-request-with-preflight-0
                        
这篇关于CORS预检后的302重定向的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！
08-14 21:03
Powered by LMLPHP ©2024 CORS预检后的302重定向 0.038223