使用barryvdh/ Laravel -cors不工作的angularJS

Question

我对IIS上承载的API的跨域请求有问题。

我正在使用angularjs应用程序从API中获取数据，该API是用laravel 5开发的，使用tymondesigns/ JWT和barryvdh/laravel包开发，用于JWT和CORS。

当API托管在angularjs应用程序上时，当data.But托管在IIS上时，它会产生以下错误：

XMLHttpRequest cannot load http://example.com/api/authenticate. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost' is therefore not allowed access.

飞行前请求响应头：

Request URL:http://example.com/api/authenticate
Request Method:OPTIONS
Status Code:200 OK
Allow:OPTIONS, TRACE, GET, HEAD, POST
Content-Length:0
Public:OPTIONS, TRACE, GET, HEAD, POST
Server:Microsoft-IIS/8.5
X-Powered-By:ASP.NET

我的第一个问题是为什么在IIS上托管时不设置“访问-控制-允许-原产地”。是否有任何特殊设置来启用IIS上的CORS。

因此，我在web.config文件中添加了以下行：

<httpProtocol>
    <customHeaders>
        <remove name="Access-Control-Allow-Origin" />   
        <add name="Access-Control-Allow-Origin" value="*" />
        <remove name="Access-Control-Allow-Headers" />
       <add name="Access-Control-Allow-Headers" value="Origin, Content-Type, Authorization, Accept, X-Request-With" />
   </customHeaders>
</httpProtocol>

现在，它给出了以下错误：

XMLHttpRequest cannot load http://example.com/api/authenticate. The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost, *', but only one is allowed. Origin 'http://localhost' is therefore not allowed access.

飞行前请求响应头：

Request Method:OPTIONS
Status Code:200 OK
Access-Control-Allow-Headers:Origin, Content-Type, Authorization, Accept, X-Request-With
Access-Control-Allow-Origin:*
Allow:OPTIONS, TRACE, GET, HEAD, POST
Public:OPTIONS, TRACE, GET, HEAD, POST
Server:Microsoft-IIS/8.5
X-Powered-By:ASP.NET

实际请求响应标头：

Request Method:POST
Status Code:200 OK
Access-Control-Allow-Headers:Origin, Content-Type, Authorization, Accept, X-Request-With
Access-Control-Allow-Origin:http://localhost
Access-Control-Allow-Origin:*
Content-Type:application/json
Server:Microsoft-IIS/8.5
Set-Cookie:XSRF-TOKEN=eyJpdiI6IkpwNnU2mTnc9PSIsInam9jTFpxb0ptak1IMmFsQ3ZZhbMTM5ZTMzMjgyZWIyNCJ9; expires=Thu, 27-Aug-2015 12:52:55 GMT; Max-Age=7200; path=/; httponly
Vary:Origin
X-Powered-By:ASP.NET
X-Powered-By:PHP/5.6.0

那么，为什么“访问-控制-允许-起源”重复“在实际的请求响应头。

在web.config文件中添加“访问控制-允许-原产地”安全吗？

Answer 1

解决这一问题的适当办法是：

• 将CORS模块安装在IIS和
• 在web.config文件中配置CORS

IIS模块配置引用