不允许返回405方法的JQuery Ajax POST到Web API

Question

    function createLokiAccount(someurl) {
    var d = {"Jurisdiction":17}

        $.ajax({
                type: "POST",
                url:"http://myserver:111/Api/V1/Customers/CreateCustomer/",
                data: JSON.stringify(d),
                contentType: "application/json; charset=utf-8",
                dataType: "json",
                success: function(data){alert(data);},
                failure: function(errMsg) {
                    alert(errMsg);
                }
            });
    }

    [HttpPost]
    public CreateCustomer.Response CreateCustomer(CreateCustomer.Request request)
    {
        HttpContext.Current.Response.AppendHeader("Access-Control-Allow-Origin", "*");
    ...

OPTIONS http://myserver:111/Api/V1/Customers/CreateCustomer/ 405 (Method Not Allowed) 
No 'Access-Control-Allow-Origin' header is present on the requested resource.      

当我从Fiddler执行POST请求时，它应该在响应头中包含“Access-Control-Allog-Origin:*”，这表明API配置正确，但（从Fiddler）jquery请求看起来如下：

选项http://myserver:111/api/v1/customers/createcustomer/http/1.1主机:myserver:111连接：keep-alive access-control-request-method：POST origin:http://localhost:6500 user-agent:mozilla/5.0（Windows NT 6.1；WOW64)applewebkit/537.36(KHTML,like Gecko）chrome/34.0.1847.116 safari/537.36 access-control-request-headers：accept,content-type,en-gb；q=0.6,it-it；q=0.4,it；q=0.2

那么为什么我的POST请求变成了选项请求呢？

Answer 1

首先，您只添加了一个标题，但至少需要三个标题：

"Access-Control-Allow-Origin", "*"

"Access-Control-Allow-Methods", "GET, POST, PUT, DELETE"

"Access-Control-Allow-Headers", "Content-Type, Accept"

其次，如果您只为某个控制器中的一个方法需要CORS，那么添加头的方式是可以的。但总的来说，这是不对的。

ASP.NET5和Web API2提供了CORS库。

protected void Application_BeginRequest(object sender, EventArgs e)
{
    HttpContext.Current.Response.AddHeader("Access-Control-Allow-Origin", "*");
    if (HttpContext.Current.Request.HttpMethod == "OPTIONS")
    {
        HttpContext.Current.Response.AddHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
        HttpContext.Current.Response.AddHeader("Access-Control-Allow-Headers", "Content-Type, Accept");
        HttpContext.Current.Response.AddHeader("Access-Control-Max-Age", "1728000");
        HttpContext.Current.Response.End();
    }

}