Blazor请求被PHP API上的CORS策略阻止

我正在基于客户端Blazor设置一个PHP API和一个网页。但是由于某种原因,触发了CORS,并且我的登录过程或对PHP页面的任何请求都导致CORS错误。

我开始使用C#控制台应用程序和Blazor应用程序测试我的PHP API,我尝试使用没有任何数据库访问权限来测试功能。 Blazor现在与Preview 9一起运行。PHP版本为5.3.8。从理论上讲,我可以对其进行更新,但是正在运行其他几个活动项目,而我没有任何测试环境。 MySQL版本5.5.24。

首先我发现可能是因为我在本地计算机上运行它,所以我将其推送到同时运行PHP和MySQL的网站。仍然我遇到了这个CORS错误。

我仍在测试,因此我尝试将其设置为允许任何来源。在此之前,我还没有使用CORS的经验。可以肯定的是,我应该能够在访问的每个文件中添加允许CORS的PHP代码,但是由于它们都应该位于同一网站上,所以我认为CORS甚至不相关吗?

PHP代码:

function cors() {

// Allow from any origin
if (isset($_SERVER['HTTP_ORIGIN'])) {
    // Decide if the origin in $_SERVER['HTTP_ORIGIN'] is one
    // you want to allow,and if so:
    header("access-control-allow-origin: {$_SERVER['HTTP_ORIGIN']}");
    header('access-Control-Allow-Credentials: true');
    header('access-Control-Max-Age: 86400');    // cache for 1 day
}

// access-Control headers are received during OPTIONS requests
if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {

    if (isset($_SERVER['HTTP_accESS_CONTROL_REQUEST_METHOD']))
        // may also be using PUT,PATCH,HEAD etc
        header("access-Control-Allow-Methods: GET,POST,OPTIONS");         

    if (isset($_SERVER['HTTP_accESS_CONTROL_REQUEST_HEADERS']))
        header("access-Control-Allow-Headers: {$_SERVER['HTTP_accESS_CONTROL_REQUEST_HEADERS']}");

    exit(0);
}

echo "You have CORS!";
}
cors();

使用注入的HttpClient的C#代码:

var resp = await Http.GetStringAsync(link);

我得到的错误是:

access to fetch at 'https://titsam.dk/ntbusit/busitapi/requestLoginToken.php' from origin 'https://www.titsam.dk' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'access-control-allow-origin' header is present on the requested resource. If an opaque response serves your needs,set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

我希望得到的答复是,我使用的链接像登录API一样返回登录令牌。

是因为它可能正在运行客户端,并且这会触发CORS吗?但这似乎不能解释为什么我不能让它全部允许。

更新: 我在OnInitializedAsync中的C#代码:

link = API_RequestLoginTokenEndPoint;

Http.DefaultRequestHeaders.Add("User-Agent","HttpClientFactory-Sample");
Http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Authorization","basic:testuser:testpass");

var requestMessage = new HttpRequestMessage(HttpMethod.Get,link);

requestMessage.Properties[WebAssemblyHttpMessageHandler.FetchArgs] = new
{
    credentials = "include"
};

var response = await Http.SendAsync(requestMessage);
var responseStatusCode = response.StatusCode;
var responseBody = await response.Content.ReadAsStringAsync();

output = responseBody + " " + responseStatusCode;

更新2: 终于可以了。我链接的C#代码是Agua From Mars提出的解决方案,它解决了将SendAsync与HttpRequestMessage一起使用并向其中添加Fetch属性包含凭据的问题。另一种选择是将此行添加到启动中:

WebAssemblyHttpMessageHandler.DefaultCredentials = FetchCredentialsOption.Include;

然后,我可以继续使用GetStringAsync(因为它成为默认值)开始做我想做的事情。 等待Http.GetStringAsync(API_RequestLoginTokenEndPoint);

因此,Agua From Mars建议的所有解决方案都有效。但是我遇到了一个浏览器问题,即使解决了问题,它仍然以某种方式将CORS问题保留在缓存中,因此似乎没有任何变化。某些代码更改将显示不同的结果,但我想CORS部分仍然有效。借助Chrome,它有助于打开新的窗格或窗口。在我的Opera浏览器中,这还不够,我不得不在站点打开的情况下关闭所有窗格,以确保清除缓存,然后在站点中也可以在站点中打开新窗口或窗格。我已经在两种浏览器中尝试使用ctrl-F5和Shift-F5来使它们清除缓存。这没有任何改变。

我希望这将有助于其他人避免在此类问题上花费2-3天。

qianqianyouer 回答:Blazor请求被PHP API上的CORS策略阻止

更新3.1-preview3

在3.1-preview3中,我们无法对每条消息使用fetch选项,该选项是全局的

WebAssemblyHttpMessageHandlerOptions.DefaultCredentials = FetchCredentialsOption.Include;

WebAssemblyHttpMessageHandler已被删除。使用的HttpMessageHanlderWebAssembly.Net.Http.HttpClient.WasmHttpMessageHandler中的WebAssembly.Net.Http,但在您的依赖关系中不要包含WebAssembly.Net.Http,否则应用程序将无法启动。

如果要使用HttpClientFactory,可以这样实现:

public class CustomDelegationHandler : DelegatingHandler
{
    private readonly IUserStore _userStore;
    private readonly HttpMessageHandler _innerHanler;
    private readonly MethodInfo _method;

   public CustomDelegationHandler(IUserStore userStore,HttpMessageHandler innerHanler)
   {
       _userStore = userStore ?? throw new ArgumentNullException(nameof(userStore));
       _innerHanler = innerHanler ?? throw new ArgumentNullException(nameof(innerHanler));
       var type = innerHanler.GetType();
       _method = type.GetMethod("SendAsync",BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.InvokeMethod) ?? throw new InvalidOperationException("Cannot get SendAsync method");
       WebAssemblyHttpMessageHandlerOptions.DefaultCredentials = FetchCredentialsOption.Include;
   }
   protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,CancellationToken cancellationToken)
   {
        request.Headers.Authorization = new AuthenticationHeaderValue(_userStore.AuthenticationScheme,_userStore.AccessToken);            
        return _method.Invoke(_innerHanler,new object[] { request,cancellationToken }) as Task<HttpResponseMessage>;
   }
}

public void ConfigureServices(IServiceCollection services)
{
    services.AddTransient(p =>
    {
        var wasmHttpMessageHandlerType =  Assembly.Load("WebAssembly.Net.Http")
                        .GetType("WebAssembly.Net.Http.HttpClient.WasmHttpMessageHandler");
        var constructor = wasmHttpMessageHandlerType.GetConstructor(Array.Empty<Type>());
        return constructor.Invoke(Array.Empty<object>()) as HttpMessageHandler;
    })
    .AddTransient<CustomDelegationHandler>()
    .AddHttpClient("MyApiHttpClientName")
    .AddHttpMessageHandler<CustonDelegationHandler>();
}

3.0-> 3.1-preview2

在Blazor客户端,您需要告诉Fetch API发送凭据(cookie和授权标头)。

它在 Blazor文档 Cross-origin resource sharing (CORS)

中进行了描述
        requestMessage.Properties[WebAssemblyHttpMessageHandler.FetchArgs] = new
        { 
            credentials = FetchCredentialsOption.Include
        };

例如:

@using System.Net.Http
@using System.Net.Http.Headers
@inject HttpClient Http

@code {
    private async Task PostRequest()
    {
        Http.DefaultRequestHeaders.Authorization =
            new AuthenticationHeaderValue("Bearer","{OAUTH TOKEN}");

        var requestMessage = new HttpRequestMessage()
        {
            Method = new HttpMethod("POST"),RequestUri = new Uri("https://localhost:10000/api/TodoItems"),Content = 
                new StringContent(
                    @"{""name"":""A New Todo Item"",""isComplete"":false}")
        };

        requestMessage.Content.Headers.ContentType = 
            new System.Net.Http.Headers.MediaTypeHeaderValue(
                "application/json");

        requestMessage.Content.Headers.TryAddWithoutValidation(
            "x-custom-header","value");

        requestMessage.Properties[WebAssemblyHttpMessageHandler.FetchArgs] = new
        { 
            credentials = FetchCredentialsOption.Include
        };

        var response = await Http.SendAsync(requestMessage);
        var responseStatusCode = response.StatusCode;
        var responseBody = await response.Content.ReadAsStringAsync();
    }
}

您可以使用WebAssemblyHttpMessageHandlerOptions.DefaultCredentials静态属性来全局设置此选项。

或者您可以实现DelegatingHandler并使用HttpClientFactory在DI中进行设置:

    public class CustomWebAssemblyHttpMessageHandler : WebAssemblyHttpMessageHandler
    {
        internal new Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,CancellationToken cancellationToken)
        {
            return base.SendAsync(request,cancellationToken);
        }
    }

    public class CustomDelegationHandler : DelegatingHandler
    {
        private readonly CustomWebAssemblyHttpMessageHandler _innerHandler;

        public CustomDelegationHandler(CustomWebAssemblyHttpMessageHandler innerHandler)
        {
            _innerHandler = innerHandler ?? throw new ArgumentNullException(nameof(innerHandler));
        }
        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request,CancellationToken cancellationToken)
        {
            request.Properties[WebAssemblyHttpMessageHandler.FetchArgs] = new
            {
                credentials = "include"
            };
            return _innerHandler.SendAsync(request,cancellationToken);
        }
    }

Setup.ConfigureServices

services.AddTransient<CustomWebAssemblyHttpMessageHandler>()
    .AddTransient<WebAssemblyHttpMessageHandler>()
    .AddTransient<CustomDelegationHandler>()
    .AddHttpClient(httpClientName)
    .AddHttpMessageHandler<CustomDelegationHandler>();

然后,您可以使用HttpClient为您的API创建一个IHttpClientFactory.CreateClient(httpClientName)

要使用IHttpClientFactory,您需要安装Microsoft.Extensions.Http软件包。

3.0-preview3 => 3.0-preview9

WebAssemblyHttpMessageHandler替换为BlazorHttpMessageHandler

本文链接:https://www.f2er.com/3168287.html

大家都在问