AWS S3静态站点CORS jquery ajax POST到API网关

Question

我们有一个位于S3上的静态web站点。
从页面中，我们执行一个jquery ajax post到AWS api Gateway/lambda函数。
我不确定选项是如何工作的，但当我们启用“Chrome allow cross origin插件”时，所有工作都很好（我们得到了JSON响应），
当插件被禁用时，我们得到错误“Request header field access-control-allow origin is not allow by access-control-allow headers in preflight response”
有没有可能在没有插件的情况下执行post并得到一个成功的响应，我们也启用了API网关上的CORS。

这是AJAX的帖子

$.ajax({
type: 'POST',
url: API_URL,
data: JSON.stringify(inputdata),
dataType: 'json',
 beforeSend: function(xhr) {
xhr.setRequestHeader("Access-Control-Allow-Origin", "*");
xhr.setRequestHeader("Access-Control-Allow-Methods", "OPTIONS,POST");
xhr.setRequestHeader("Access-Control-Allow-Headers", "X-Requested-With,Access-Control-Allow-Headers,Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token");
xhr.setRequestHeader("Content-Type", "application/json");
 //xhr.setRequestHeader("origin", "http://evil.com/");
},
/*
headers: {

        'Access-Control-Allow-Headers':'Access-Control-Allow-Headers,Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token',
        'Access-Control-Allow-Origin' : '*',
        'Access-Control-Allow-Methods' : 'OPTIONS,POST',
        'Access-Control-Allow-Credentials' : true,
        'Content-Type': 'application/json; charset=utf-8'
},*/
crossDomain: true,
success: function (data) {getdatasuccess(data)},
error: function(data){
console.log("error = "+JSON.stringify(data));
}
});

启用“允许交叉起源插件”插件时的响应头

：authority:64j2k6w2dc.execute-api.us-east-1.amazonaws.com
:方法：选项
:路径：/prod
:方案：https
accept:/
accept-encoding：gzip,deflate,br
accept-language：en-us,en；q=0.8
access-control-request-headers：access-control-request-headers,access-control-request-meaders,access-control-request-meaders,access-control-request-methods,access-control-type
access-control-request-methods,；x64)AppleWebKit/537.36(KHTML，像壁虎）Chrome/61.0.3163.100 Safari/537.36

“允许交叉起源插件”插件被禁用时的响应头

：authority:64j2k6w2dc.execute-api.us-east-1.amazonaws.com
:方法：选项
:路径：/prod
:方案：https
accept:/
accept-encoding：gzip,deflate,br
accept-language：en-us,en；q=0.8
access-control-request-headers：access-control-request-meaders,access-control-request-meaders,access-control-request-meaders,access-control-request-meaders,access-control-request-methods,access-control-type mysitetest/htmlpage2.html
用户代理：Mozilla/5.0（Windows NT 6.3；Win64；x64)AppleWebkit/537.36（KHTML,like Gecko）Chrome/61.0.3163.100 Safari/537.36

Answer 1

它对我有用：

API网关>方法选项>集成响应>头映射：

Access-Control-Allow-Headers：“Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-XSRF-TOKEN,Access-Control-Allow-Headers,Access-Control-Allow-Origin”