HTTP headers 授权作为选项发送

Question

我正在制作一个基于令牌的认证系统。当用户登录时发送回令牌，然后在每次调用服务器时提交

分配令牌

   .factory('AuthenticationService', function($rootScope, $http, authService, $httpBackend) {
   var service = {
login: function(user) {
  $http.post('http://192.168.100.100/myApp/login', { user: user }, { ignoreAuthModule: true })
  .success(function (data, status, headers, config) {
    $http.defaults.headers.common.Authorization = data.authorizationToken; 
    console.log("token:" + data.authorizationToken);
    authService.loginConfirmed(data, function(config) {
      config.headers.Authorization = data.authorizationToken;
      return config;
    });
  })

执行此操作后，调用将作为 OPTIONS 而不是 POST 发送，问题是我发送到 RESTful 服务器，而 OPTIONS 不是 ahhh ummm一个选项。即服务器期望 POST、GET 等

Chrome 将我的 headers 显示为 ..

General

**Remote Address:** 192.168.100.100:80
**Request URL:** http://192.168.100.100/myapp/login
**Request Method:** OPTIONS
**Status Code:** 404 Not Found

Response Headers

**Access-Control-Allow-Origin:** *
**Cache-Control:** no-cache, must-revalidate
**Connection:** Keep-Alive
**Content-Encoding:** gzip
**Content-Length:** 563
**Content-Type:** text/plain
**Date:** Tue, 04 Aug 2015 04:29:14 GMT
**Expires:** 0
**Keep-Alive:** timeout=5, max=100
**Server:** Apache/2.2.22 (Debian)
**Vary:** Accept-Encoding
**X-Powered-By:** PHP/5.4.41-0+deb7u1

Request Headers

OPTIONS /myapp/login HTTP/1.1
**Host:** 192.168.100.100
**Connection:** keep-alive
**Access-Control-Request-Method:** POST
**Origin:** null
**User-Agent:** Mozilla/5.0 (Linux; U; Android 4.0; en-us; GT-I9300 Build/IMM76D)         AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
**Access-Control-Request-Headers:** authorization, content-type
**Accept:** */*
**Accept-Encoding:** gzip, deflate, sdch
**Accept-Language:** en-US,en;q=0.8

它会一直是 OPTIONS 吗？我是否必须更改我的 RESTful 服务器来适应这个，我是否应该无法在 headers 中看到令牌？

Answer 1

能否请您检查一下是否启用了 CORS？如果是，请尝试像这样处理 OPTIONS 请求

if (req.method === 'OPTIONS') {
      console.log('!OPTIONS');
      var headers = {};
      // IE8 does not allow domains to be specified, just the *
      // headers["Access-Control-Allow-Origin"] = req.headers.origin;
      headers["Access-Control-Allow-Origin"] = "*";
      headers["Access-Control-Allow-Methods"] = "POST, GET, PUT, DELETE, OPTIONS";
      headers["Access-Control-Allow-Credentials"] = false;
      headers["Access-Control-Max-Age"] = '86400'; // 24 hours
      headers["Access-Control-Allow-Headers"] = "X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept";
      res.writeHead(200, headers);
      res.end();
}

Answer 2

这是检查 CORS 是否启用的预检请求

在预检请求期间，您应该看到以下两个 headers：Access-Control-Request-Method 和 Access-Control-Request-Headers。这些请求 headers 正在向服务器请求发出实际请求的权限。您的预检响应需要确认这些 headers 才能使实际请求生效。

很快。您需要在您的服务器上启用这些 headers 才能使实际请求工作

HTTP headers 授权作为选项发送

HTTP headers with Authorize sent as OPTIONS

http

http-headers

angularjs