CakePHP 3 REST API CORS请求和OPTIONS方法

Question

我正在使用CakePHP3开发RESTAPI。我想公开启用它，这样任何人都可以调用API。因此，我添加了如下定义的cors标题：http://book.cakephp.org/3.0/en/controllers/request-response.html#setting-跨源请求头

我已经在Dispatcher上实现了EventListener。在调度和调度之前。发货前，准备cors标题。

class ApiResponseHeaders implements EventListenerInterface
{

    /**
     * Event bindings
     *
     * @return array
     */
    public function implementedEvents()
    {
        return [
            'Dispatcher.beforeDispatch' => [
                'callable' => 'beforeDispatch',
                'priority' => 0
            ],
            'Dispatcher.afterDispatch' => [
                'callable' => 'afterDispatch',
                'priority' => 99999
            ]
        ];
    }

    public function beforeDispatch(Event $event)
    {
        $request = $event->data['request'];
        if ('OPTIONS' === $request->method()) {
            $event->stopPropagation();
        }
    }

    public function afterDispatch(Event $event)
    {
        $request = $event->data['request'];
        $response = $event->data['response'];

        $response->cors($request)
                ->allowOrigin('*')
                ->allowMethods(['GET', 'POST', 'OPTIONS'])
                ->allowHeaders(['Content-Type, Authorization, X-Requested-With, Accept'])
                ->allowCredentials()
                ->maxAge(0)
                ->build();

        if ('OPTIONS' === $request->method()) {
            $event->stopPropagation();
        }
    }

}

但问题是，当我从AngularJS向APIendpoint发出POST请求时，它首先调用OPTIONS方法，然后调用POST方法。CakePHP不处理OPTIONS方法调用并返回：400坏请求

下面是示例请求和响应标头：

请求标头

OPTIONS /v1/account/login HTTP/1.1
Host: api.cake.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:48.0) Gecko/20100101 Firefox/48.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: http://demo.angular.dev
Connection: keep-alive

响应报头

HTTP/1.1 400 Bad Request
Date: Wed, 07 Sep 2016 08:34:55 GMT
Server: Apache/2.4.17 (Win64) PHP/5.6.16
X-Powered-By: PHP/5.6.16
X-DEBUGKIT-ID: b4e5654a-cefb-43b7-bf19-4e8c7ffdb0e0
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Content-Type, Authorization, X-Requested-With, Accept
Access-Control-Allow-Credentials: true
access-control-max-age: 0
Content-Length: 147
Connection: close
Content-Type: text/html; charset=UTF-8

在CakePHP3中是否有一种方法可以处理这个选项请求并返回正确的响应，从而使下一个POST请求正常工作？

请帮忙。谢谢你们

Answer 1

如果你们真的坚持这一点，然后转到配置/bootstrap.php文件，添加以下行，你的问题就消失了

header('Access-Control-Allow-Origin: *');

Answer 2

对于CakePHP 3.3版本使用这个插件：https://github.com/ozee31/cakephp-cors

Answer 3

在CakePHP 3.2中，我是这样做的：

public function beforeRender(event $event) {
    $this->setCorsHeaders();
}

public function beforeFilter(event $event) {
    if ($this->request->is('options')) {
        $this->setCorsHeaders();
        return $this->response;
    }
}

private function setCorsHeaders() {
    $this->response = $this->response->cors($this->request)
        ->allowOrigin(['*'])
        ->allowMethods(['*'])
        ->allowHeaders(['x-xsrf-token', 'Origin', 'Content-Type', 'X-Auth-Token'])
        ->allowCredentials(['true'])
        ->exposeHeaders(['Link'])
        ->maxAge(300)
        ->build();
}

这样，我甚至可以处理CakePHP错误页面。

根据您的情况，您可以更改alloHeaders数组上的值。

请记住，如果请求将with Creentials设置为true，则需要指定起源。