浏览器中不允许跨源调用

Question

     List<String> originList = Arrays.asList(origins.trim().split("( )*,( )*"));
    String origin = request.getHeader("Origin");
    if (originList.contains(origin)) {
        originAllow = origin;
    } else {
        originAllow = originList.get(0);
    }
     response.setHeader("Access-Control-Allow-Origin", originAllow);
    response.setHeader("Access-Control-Allow-Credentials", "true");
    response.setHeader("Access-Control-Allow-Methods", "PUT, POST, GET, OPTIONS, DELETE, PATCH");
    response.setHeader("Access-Control-Max-Age", "3600");
    response.setHeader("Access-Control-Allow-Headers", "x-requested-with, accept, authorization");
    response.setHeader("Access-Control-Expose-Headers", "Location");

在originAllow中,我正在传递我试图访问的url,但我得到以下错误,

     XMLHttpRequest cannot load http://<<url>>. Request header field Authorization is not allowed by Access-Control-Allow-Headers in preflight response.

请查找浏览器请求和响应头，响应头

Access-Control-Allow-Headers:x-requested-with, content-type
    Access-Control-Allow-Methods:GET OPTIONS
    Access-Control-Allow-Origin:*
    Access-Control-Max-Age:3600
    Allow:GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
    Connection:close
    Content-Length:0
    Content-Type:text/plain; charset=UTF-8
    Server:Apache-Coyote/1.1
    X-Application-Context::8080
    

    Request Header
    Accept:/
Accept-Encoding:gzip, deflate, sdch
Accept-Language:en-US,en;q=0.8,ms;q=0.6
Access-Control-Request-Headers:authorization, x-requested-with
Access-Control-Request-Method:GET
Connection:keep-alive
Host:myrestapi-dev
Origin:http://localhost:9000
Referer:http://localhost:9000/
User-Agent:Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
选项<>？page=0&search_param=test&size=10,desc HTTP/1.1
主机：myrestapi-dev
连接：keep-alive
access-control-request-method：
来源：http：//localhost:9000
用户代理：Mozilla/5.0（Windows NT 6.1；Win64；x64)AppleWebKit/537.36（KHTML,像Gecko一样）Chrome/52.0.2743.116 Safari/537.36
access-control-request-headers：授权，x-requested-with
接受：/
引用人：http://localhost:9000/
接受编码：gzip,deflate,sdch
接受语言：en-US,en；q=0.8,ms；q=0.6

请让我知道有什么我需要添加的访问url从ui（角度）的授权，而且它是工作在其他浏览器，但不是在chrome
                

Answer 1

这是因为您的服务器不允许授权头。要解决这个问题：

response.setHeader("Access-Control-Allow-Headers", "Content-Type, authorization");

应该能帮到你。由于我不确定您的后端，我需要解释更多一点。这是因为由服务器指定它接受跨源请求（并且它允许content-type请求头）。此外，您需要从同一域进行AJAX调用或进行服务器端更改，以允许来自外部域的请求。为了解决这一问题，您需要在http://yourdomain.com上通过允许外部域在头中进行更改：

Access-Control-Allow-Origin: *

1-ref1

AngularJS$HTTP服务有一个名为“jsonp”的内置方法。

var url = "some REST API Url" + "?callback=JSON_CALLBACK";

$http.jsonp(url)
    .success(function(data){
       // whatever 
    });

此外，url必须附加？callback=json_callback。

我将使用JSONP扩展这个解决方案

exampleurl = 'http://wikidata.org/w/api.php?whatever....&format=json'

 //Number 1 : 
 $.ajax({
  dataType: "jsonp",
  url: exampleurl ,
  }).done(function ( data ) {
  // do whatever
});
//Number 2 : 
$.ajax({
  dataType: "json",
  url: exampleurl + '&callback=?',
  }).done(function ( data ) {
  // do whatever
});
//Number 3 : 
$.getJSON( exampleurl + '&callback=?', function(data) {
  // do whatever
});