下面給大家介紹thinkphp withCredentials 跨域問題解決思路，希望對需要的朋友有所幫助！
thinkphp withCredentials 跨域問題解決思路
跨域是什么這里就不細(xì)講, 這里主要是thinkphp5.1, 說一下大概的解決思路
首先,因為前端是自己寫的, 在axios配置中, 我設(shè)置了如下
withCredentials: true // 跨域請求時發(fā)送cookie
// 創(chuàng)建一個axios
const service = axios.create({
baseURL: URL ,
withCredentials: true, // 跨域請求時發(fā)送cookie
timeout: 5000 // request timeout
})在后端的配置中，配置的是
header("Access-Control-Allow-Origin: *");故而拋出了這樣一個錯誤
Access to XMLHttpRequest at 'http://store.ink/admin/me?sid=lbn3mpacfb3k1mbehnk9qh8kf3' from origin 'http://vue-admin-web.ink' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.
意思大概為 設(shè)置 withCredentials 為 true 時, origin 是不允許為 *的, origin必須設(shè)置為來源的地址
也就是 http://a.com 請求 http://b.com 的時候, http://a.com 必須設(shè)置origin 為 http://b.com 才能通過
最后參閱配置如下
$origin = $_SERVER['HTTP_ORIGIN'] ?? '*';
header("Access-Control-Allow-Origin: $origin");
header('Access-Control-Allow-Credentials: true');
header('Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With');
header('Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE');
header('Access-Control-Max-Age: 1728000');當(dāng)然, 為 * 的時候也可以這樣
header("Access-Control-Allow-Origin: *");
header('Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With');
header('Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE');
header('Access-Control-Max-Age: 1728000');首先 定義個中間件 php think make:middleware CrossDomain
<?php
namespace app\http\middleware;
use think\Response;
class CrossDomain
{
public function handle($request, \Closure $next)
{
$origin = $_SERVER['HTTP_ORIGIN'] ?? '*';
header("Access-Control-Allow-Origin: $origin");
header('Access-Control-Allow-Credentials: true');
header('Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With');
header('Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE');
header('Access-Control-Max-Age: 1728000');
return $next($request);
}
}在router.php中
Route::group('', function (){
....
這里寫路由
....
})->middleware(['CrossDomain']);然后又有一個新問題
因為如上是走的路由文件,當(dāng)請求的url匹配路由的時候, 會走跨域中間件, 當(dāng)大家都知道的是, delete 和 put 等方法是會提前發(fā)起一個options請求的, 也就是無法匹配路由文件,無法走跨域中間件
故而:
定義一個 錯誤異常接管 https://www.kancloud.cn/manual/thinkphp5_1/354092#_42
....
public function render(Exception $e)
{
# 這里來處理跨域問題
$origin = $_SERVER['HTTP_ORIGIN'] ?? '*';
header("Access-Control-Allow-Origin: $origin");
header('Access-Control-Allow-Credentials: true');
header('Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With');
header('Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE');
header('Access-Control-Max-Age: 1728000');
$type = request()->isAjax() ? 'json' : "html";
$response = \think\response\Json::create([], $type, 200, []);
return $response; # response // 在異常處理接管中,必須返回的是一個人response響應(yīng), 而不是 `throw new `拋出一個響應(yīng)
}
...完成。
