yii跨域处理_Yii2 REST +角跨域CORS

I have developed Angular & Yii2 REST service. Have problem in cross domain.

Here below add my angular & Yii2 REST Code.

$http.defaults.useXDomain = true;

$http.defaults.withCredentials = true;

$http.defaults.headers.common['Authorization'] = 'Bearer ' + MYTOKEN

My Request from Angular Controller:

apiURL = 'http://api.example.com';

$http.get(apiURL + '/roles')

.success(function (roles) { })

.error(function () { });

Yii2 .htaccess: (REST URL like 'http://api.example.com')

Header always set Access-Control-Allow-Origin: "*"

Header always set Access-Control-Allow-Credentials: true

Header always set Access-Control-Allow-Methods "POST, GET, PUT, DELETE, OPTIONS"

Header always set Access-Control-Allow-Headers "Authorization,X-Requested-With, content-type"

Yii2 My Behaviour:

public function behaviors() {

$behaviors = parent::behaviors();

$behaviors['corsFilter'] = [

'class' => Cors::className(),

'cors' => [

'Origin' => ['*'],

'Access-Control-Expose-Headers' => [

'X-Pagination-Per-Page',

'X-Pagination-Total-Count',

'X-Pagination-Current-Page',

'X-Pagination-Page-Count',

],

],

];

$behaviors['authenticator'] = [

'class' => HttpBearerAuth::className(),

'except' => ['options'],

];

$behaviors['contentNegotiator'] = [

'class' => ContentNegotiator::className(),

'formats' => [

'application/json' => Response::FORMAT_JSON,

],

];

return $behaviors;

}

Problem

From my angular request is 'GET' method, but it will goes 'OPTIONS' method & return 401 Unauthorized error(CORS). because the request Authorization header is not send.

解决方案

Update:

As pointed by @jlapoutre, this is now well described in official docs:

Adding the Cross-Origin Resource Sharing filter to a controller is a

bit more complicated than adding other filters described above,

because the CORS filter has to be applied before authentication

methods and thus needs a slightly different approach compared to other

filters. Also authentication has to be disabled for the CORS Preflight

requests so that a browser can safely determine whether a request can

be made beforehand without the need for sending authentication

credentials. The following shows the code that is needed to add the

yii\filters\Cors filter to an existing controller that extends from

yii\rest\ActiveController:

use yii\filters\auth\HttpBasicAuth;

public function behaviors()

{

$behaviors = parent::behaviors();

// remove authentication filter

$auth = $behaviors['authenticator'];

unset($behaviors['authenticator']);

// add CORS filter

$behaviors['corsFilter'] = [

'class' => \yii\filters\Cors::className(),

];

// re-add authentication filter

$behaviors['authenticator'] = $auth;

// avoid authentication on CORS-pre-flight requests (HTTP OPTIONS method)

$behaviors['authenticator']['except'] = ['options'];

return $behaviors;

}

Old Answer (deprecated)

There is an ordering issue when merging with parent::behaviors(). Full details here.

I would recommend not defining keys when merging with parent array:

public function behaviors()

{

return \yii\helpers\ArrayHelper::merge([

[

'class' => \yii\filters\Cors::className(),

'cors' => [...],

],

[

'class' => \yii\filters\auth\HttpBearerAuth::className(),

'except' => ['options'],

],

[

'class' => ContentNegotiator::className(),

'formats' => [...],

]

], parent::behaviors());

}

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值