CORS 铬通配符 '*' 角度 8？

Question

我得到以下消息CORS只在Chrome，Mozilla工作正常:

CORS策略阻止从源http://172.16.30.79:4200在http://localhost:8002/dataHub/negotiate处访问XMLHttpRequest：对预飞行请求的响应无法通过权限改造检查：当请求的凭据模式为“包含”时，响应中“访问控制允许源”标头的值不能是通配符“*”。由XMLHttpRequest发起的请求的凭据模式由with凭据属性控制。

服务器返回我这些标头：

Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: x-requested-with,Vary,Server,Access-Control-Allow-Origin,Access-Control-Allow-Credentials,Access-Control-Allow-Headers,Access-Control-Allow-Methods,Date
Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Vary, Server, Access-Control-Allow-Origin, Access-Control-Allow-Credentials, Access-Control-Allow-Headers, Access-Control-Allow-Methods, Date
Content-Type: application/json; charset=utf-8
Date: Mon, 23 Sep 2019 18:32:09 GMT
Server: Microsoft-IIS/10.0
Vary: Origin
X-Content-Type-Options: nosniff

我使用信号器的连接是：

this.connection = new signalR.HubConnectionBuilder()
      .configureLogging(signalR.LogLevel.Debug)
      .withUrl("http://localhost:8002/dataHub")
      .build();

 this.connection
      .start({withCredentials: false})
      .then(() => {
});

如您所见，服务器发送了一个报头:

Access-Control-Allow-Origin: *

在Mozilla中，我看到了< code > Access-Control-Allow-Origin:http://172 . 16 . 30 . 79:4200

为什么Chrome替换Access-Control-Allo-Origin：http://172.16.30.79:4200onAccess-Control-Allo-Origin：*我不知道。

Answer 1

在您的配置上：

//Configure CORS policy
services.AddCors(options =>
{
  options.AddPolicy("CorsPolicy",
  builder => builder.WithOrigins("http://172.16.30.79:4200")
  .SetIsOriginAllowed((host) => true)
  .AllowAnyMethod()
  .AllowAnyHeader()
  .AllowCredentials());
});

然后在上配置：

//Cors Policy
app.UseCors("CorsPolicy");