新鲜出炉的跨域问题：前端设置credential: ‘include‘，后端不能用‘*‘通配符匹配所有源

最后更新于2022年9月5日 14:50:46

前端报错：${ 你的请求 }has been blocked by CORS policy: The value of the ‘Access-Control-Allow-Origin’ header in the response must not be the wildcard ‘*’ when the request’s credentials mode is ‘include’

原因：MDN明确写了，不让这么玩儿：Sending a request with credentials included

Note: Access-Control-Allow-Origin is prohibited from using a wildcard for requests with credentials: ‘include’. In such cases, the exact origin must be provided; even if you are using a CORS unblocker extension, the requests will still fail.

方法：设置白名单，参见：使用gin搭建api后台系统之跨域问题
我是把白名单写成JSON然后读取了。