从请求中剥离的CORS自定义标头

2024-05-08 • 问答

我正在使用基于令牌的Lambda授权器，如下所述： https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html

现在我仍在使用玩具示例，其中标题道具为tokenHeader

我的提取如下：

export function logout() {
    return (dispatch,getState) => {
      return fetch('https://account-api.example.com/v1/logout',{
        method: 'GET',headers: {
          'access-Control-Request-Method': 'GET','access-Control-Request-Headers': 'Content-Type,Authorization','Content-Type': 'application/json','tokenHeader':'allow',},credentials: 'include'
      })
        .then((response) => {
          return response.json().then((body) => {
            return {
              status: body.statusCode,payload:body.payload,};
          },);
        })
        .then((response) => {
          console.log("response",response)
          if (response.status !== 200) {
            dispatch({ type: 'LOGOUT_ERROR',payload: response.payload.error});
          }
          if (response.status === 200) {
            dispatch({ type: 'LOGOUT_SUCCESSFUL',payload: response.payload });
          }
        })
        .catch(error => {
          dispatch({ type: 'LOGOUT_FAILED',payload: String(error)});
        })
    };
  }

当我查看网络标签时，我的请求中缺少'tokenHeader':'allow'标头，导致授权者显示401-我该怎么做才能防止此标头被剥夺？