phpwithcredentials,thinkphpwithCredentials跨域问题解决思路

跨域是什么这里就不细讲, 这里主要是thinkphp5.1, 说一下大概的解决思路

首先,因为前端是自己写的, 在axios配置中, 我设置了如下

withCredentials: true // 跨域请求时发送COOKIE

// 创建一个axios

const service &＃61; axios.create({

baseURL: URL ,

withCredentials: true, // 跨域请求时发送COOKIE

timeout: 5000 // request timeout

})

在后端的配置中,配置的是

header("Access-Control-Allow-Origin: *");

故而抛出了这样一个错误

Access to XMLHttpRequest at &＃39;http://store.ink/admin/me?sid&＃61;lbn3mpacfb3k1mbehnk9qh8kf3&＃39; from origin &＃39;http://vue-admin-web.ink&＃39; has been blocked by CORS policy: The value of the &＃39;Access-Control-Allow-Origin&＃39; header in the response must not be the wildcard &＃39;*&＃39; when the request&＃39;s credentials mode is &＃39;include&＃39;. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

意思大概为 设置 withCredentials 为 true 时, origin 是不允许为 *的, origin必须设置为来源的地址

最后参阅配置如下

$origin &＃61; $_SERVER[&＃39;HTTP_ORIGIN&＃39;] ?? &＃39;*&＃39;;

header("Access-Control-Allow-Origin: $origin");

header(&＃39;Access-Control-Allow-Credentials: true&＃39;);

header(&＃39;Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With&＃39;);

header(&＃39;Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE&＃39;);

header(&＃39;Access-Control-Max-Age: 1728000&＃39;);

当然, 为 * 的时候也可以这样

header("Access-Control-Allow-Origin: *");

header(&＃39;Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With&＃39;);

header(&＃39;Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE&＃39;);

header(&＃39;Access-Control-Max-Age: 1728000&＃39;);

首先 定义个中间件 php think make:middleware CrossDomain

namespace app\http\middleware;

use think\Response;

class CrossDomain

{

public function handle($request, \Closure $next)

{

$origin &＃61; $_SERVER[&＃39;HTTP_ORIGIN&＃39;] ?? &＃39;*&＃39;;

header("Access-Control-Allow-Origin: $origin");

header(&＃39;Access-Control-Allow-Credentials: true&＃39;);

header(&＃39;Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With&＃39;);

header(&＃39;Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE&＃39;);

header(&＃39;Access-Control-Max-Age: 1728000&＃39;);

return $next($request);

}

}

在router.php中

Route::group(&＃39;&＃39;, function (){

....

这里写路由

....

})->middleware([&＃39;CrossDomain&＃39;]);

然后又有一个新问题

因为如上是走的路由文件,当请求的url匹配路由的时候, 会走跨域中间件, 当大家都知道的是, delete 和 put 等方法是会提前发起一个options请求的, 也就是无法匹配路由文件,无法走跨域中间件

故而:

....

public function render(Exception $e)

{

# 这里来处理跨域问题

$origin &＃61; $_SERVER[&＃39;HTTP_ORIGIN&＃39;] ?? &＃39;*&＃39;;

header("Access-Control-Allow-Origin: $origin");

header(&＃39;Access-Control-Allow-Credentials: true&＃39;);

header(&＃39;Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-Requested-With&＃39;);

header(&＃39;Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE&＃39;);

header(&＃39;Access-Control-Max-Age: 1728000&＃39;);

$type &＃61; request()->isAjax() ? &＃39;json&＃39; : "html";

$response &＃61; \think\response\Json::create([], $type, 200, []);

return $response; # response // 在异常处理接管中,必须返回的是一个人response响应, 而不是 &＃96;throw new &＃96;抛出一个响应

}

...

完成