thinkphp withCredentials 跨域問題解決思路

跨域是什麼這裏就不細講, 這裏主要是thinkphp5.1, 說一下大概的解決思路

首先,由於前端是本身寫的, 在axios配置中, 我設置了以下

withCredentials: true // 跨域請求時發送cookie

// 建立一個axios
const service = axios.create({
  baseURL: URL , 
  withCredentials: true, // 跨域請求時發送cookie
  timeout: 5000 // request timeout
})

在後端的配置中,配置的是

header("Access-Control-Allow-Origin: *");

故而拋出了這樣一個錯誤

Access to XMLHttpRequest at 'http://store.ink/admin/me?sid=lbn3mpacfb3k1mbehnk9qh8kf3' from origin 'http://vue-admin-web.ink' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

意思大概爲 設置 withCredentials 爲 true 時, origin 是不容許爲 *的, origin必須設置爲來源的地址

也就是 http://a.com 請求 http://b.com 的時候, http://a.com 必須設置origin 爲 http://b.com 才能經過

最後參閱配置以下

$origin = $_SERVER['HTTP_ORIGIN'] ?? '*';
        header("Access-Control-Allow-Origin: $origin");
        header('Access-Control-Allow-Credentials: true');
        header('Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With');
        header('Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE');
        header('Access-Control-Max-Age: 1728000');

固然, 爲 * 的時候也能夠這樣

header("Access-Control-Allow-Origin: *");
        header('Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With');
        header('Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE');
        header('Access-Control-Max-Age: 1728000');

首先 定義箇中間件 php think make:middleware CrossDomain

<?php
namespace app\http\middleware;

use think\Response;


class CrossDomain
{
    public function handle($request, \Closure $next)
    {
        $origin = $_SERVER['HTTP_ORIGIN'] ?? '*';
        header("Access-Control-Allow-Origin: $origin");
        header('Access-Control-Allow-Credentials: true');
        header('Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With');
        header('Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE');
        header('Access-Control-Max-Age: 1728000');

        return $next($request);
    }
}

在router.php中

Route::group('', function (){
    ....
    這裏寫路由
    ....
})->middleware(['CrossDomain']);

而後又有一個新問題

由於如上是走的路由文件,當請求的url匹配路由的時候, 會走跨域中間件, 當你們都知道的是, delete 和 put 等方法是會提早發起一個options請求的, 也就是沒法匹配路由文件,沒法走跨域中間件

故而:

定義一個 錯誤異常接管 https://www.kancloud.cn/manua...

....
public function render(Exception $e)
{
    # 這裏來處理跨域問題 
    $origin = $_SERVER['HTTP_ORIGIN'] ?? '*';
    header("Access-Control-Allow-Origin: $origin");
    header('Access-Control-Allow-Credentials: true');
    header('Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With');
    header('Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE');
    header('Access-Control-Max-Age: 1728000');
    $type = request()->isAjax() ? 'json' : "html";
    $response = \think\response\Json::create([], $type, 200, []);
    return $response; # response  // 在異常處理接管中,必須返回的是一我的response響應, 而不是 `throw new `拋出一個響應
}
...

完成

首發: 鄧塵鋒 http://surest.cn/archives/105/