浏览器跨域问题nginx

配置调整后记得清理浏览器缓存，配置调整后记得清理浏览器缓存，配置调整后记得清理浏览器缓存

cors

有时候，当在一个页面经过XHR方式访问另外一个域名的资源时，浏览器会报CORS跨域错误。（经过新的浏览器tab页打开其它域名的资源，不会有问题），错误如：nginx

Access to XMLHttpRequest at 'http://{ip}:{port}/xxx.png' from origin 'http://59.55.125.161:8992' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

要解决该问题，在须要跨域访问的服务器上配置：web

server {
    listen       8819;
    server_name  localhost;
    
    #charset koi8-r;
    #access_log  logs/host.access.log  main;

    # 解决跨域问题 start
    add_header Access-Control-Allow-Origin *;
    add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
    add_header Access-Control-Allow-Headers 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
    add_header Access-Control-Expose-Headers 'Content-Disposition';
    
    if ($request_method = 'OPTIONS') {
        return 204;
    }
    # 解决跨域问题 end
    
    ...
}

问题

Refused to get unsafe header "Content-Disposition"

nginx配置加上add_header Access-Control-Expose-Headers 'Content-Disposition';跨域

Refused to display 'http://{otherDomainSiteUrl}:{... in a frame because it set 'X-Frame-Options' to 'sameorigin'.

A服务器访问其它域名B的资源时，若是报这个错误。则B服务器nginx上作以下配置：浏览器

add_header X-Frame-Options 'ALLOW-FROM http://{ip}:{port}';

这里的{ip}:{port}为A服务器的IP和端口。服务器

add_header X-Frame-Options 能够设置的值有：ALLOWALL/SAMEORIGIN/DENYapp

设置完以后，若是报：cors

Refused to display 'http://10.180.221.159:7078/' in a frame because it set multiple 'X-Frame-Options' headers with conflicting values ('SAMEORIGIN, ALLOWALL'). Falling back to 'deny'.

这个表示设置的X-Frame-Options冲突了。好比B项目采用spring框架，spring security自己设置了X-Frame-Options为SAMEORIGIN。
能够经过以下方式解决，在B服务器的nginx上设置：框架

proxy_hide_header X-Frame-Options;
add_header X-Frame-Options ALLOWALL;

以下错误同理：

has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost:8080, *', but only one is allowed.

原文链接：

浏览器跨域等问题 - 尚码园