访问控制允许来源具有多个域 [英] Access-control-allow-origin with multiple domains

问题描述

在我的web.config我想指定访问控制允许来源指令多个域。我不希望使用*。我试过这个语法：

In my web.config I would like to specify more than one domain for the access-control-allow-origin directive. I don't want to use *. I've tried this syntax:

<add name="Access-Control-Allow-Origin" value="http://localhost:1506, http://localhost:1502" />

这个

<add name="Access-Control-Allow-Origin" value="http://localhost:1506 http://localhost:1502" />

这个

<add name="Access-Control-Allow-Origin" value="http://localhost:1506; http://localhost:1502" />

和这个

<add name="Access-Control-Allow-Origin" value="http://localhost:1506" />
<add name="Access-Control-Allow-Origin" value="http://localhost:1502" />

但他们没有工作。
什么是正确的语法？

but none of them work. What is the correct syntax ?

推荐答案

有只能有一个访问控制允许来源响应头，这头只能有一个原产地的价值。因此，为了得到这个工作，你需要有一些code是：

There can only be one Access-Control-Allow-Origin response header, and that header can only have one origin value. Therefore, in order to get this to work, you need to have some code that:

1. 拿过原产地请求标头。


2. 检查是否起源值是白名单价值观之一。


3. 如果它是有效的，设置了访问控制允许来源与头值。

1. Grabs the Origin request header.
2. Checks if the origin value is one of the whitelisted values.
3. If it is valid, sets the Access-Control-Allow-Origin header with that value.

我不认为有任何的方式只通过web.config中做到这一点。

I don't think there's any way to do this solely through the web.config.

if (ValidateRequest()) {
    Response.Headers.Remove("Access-Control-Allow-Origin");
    Response.AddHeader("Access-Control-Allow-Origin", Request.UrlReferrer.GetLeftPart(UriPartial.Authority));

    Response.Headers.Remove("Access-Control-Allow-Credentials");
    Response.AddHeader("Access-Control-Allow-Credentials", "true");

    Response.Headers.Remove("Access-Control-Allow-Methods");
    Response.AddHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
}

这篇关于访问控制允许来源具有多个域的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！