我正在尝试使用 gorilla 多路复用器和谷歌云端点构建 API，但无法让它允许跨源请求。我在我的 Web 应用程序中使用以下代码发送请求:

$.ajax("https://my.api/echo", {
    method: "POST",
    headers: {
        "Content-Type": "application/json",
        "Authorization": "Bearer " + localStorage.id_token
    },
    data: JSON.stringify({
        "message": this.query
    })
}).done(function(response) {
    console.log(response);
});

并且在我的浏览器控制台中收到以下错误:

OPTIONS https://my.api/echo 403 ()

Failed to load https://my.api/echo: Response to preflight request
doesn't pass access control check: No 'Access-Control-Allow-Origin'
header is present on the requested resource. Origin 
'http://127.0.0.1:8081' is therefore not allowed access. The response
had HTTP status code 403.

端点的代码是:

func main() {
    r := mux.NewRouter()

    r.HandleFunc("/echo", echoHandler).Methods("POST", "OPTIONS")
    headers := handlers.AllowedHeaders([]string{"X-Requested-With", "Content-Type"})
    origins := handlers.AllowedOrigins([]string{"*"})
    methods := handlers.AllowedMethods([]string{"GET", "HEAD", "POST", "PUT", "OPTIONS"})

    http.Handle("/", r)

    port := 10080
    if portStr := os.Getenv("PORT"); portStr != "" {
        port, _ = strconv.Atoi(portStr)
    }
    log.Fatal(http.ListenAndServe(fmt.Sprintf(":%d", port), handlers.CORS(headers, origins, methods)(r)))
}

func echoHandler(w http.ResponseWriter, r *http.Request) {
    // echoHandler reads a JSON object from the body, and writes it back out.
    var msg interface{}
    if err := json.NewDecoder(r.Body).Decode(&msg); err != nil {
        if _, ok := err.(*json.SyntaxError); ok {
            errorf(w, http.StatusBadRequest, "Body was not valid JSON: %v", err)
            return
        }
        errorf(w, http.StatusInternalServerError, "Could not get body: %v", err)
        return
    }

    b, err := json.Marshal(msg)
    if err != nil {
        errorf(w, http.StatusInternalServerError, "Could not marshal JSON: %v", err)
        return
    }
    w.Write(b)
}

我的 app.yaml 是:

# [START swagger]
swagger: "2.0"
info:
  description: "My API"
  title: "My API"
  version: "1.0.0"
host: "my.api"
x-google-endpoints:
  - name: "my.api"
    target: "X.X.X.X"
    allowCors: "true"
# [END swagger]
basePath: "/"
consumes:
- "application/json"
produces:
- "application/json"
schemes:
- "https"
paths:
  "/echo":
    post:
      description: "Echo back a given message."
      operationId: "echo"
      produces:
      - "application/json"
      responses:
        200:
          description: "Echo"
          schema:
            $ref: "#/definitions/echoMessage"
      parameters:
      - description: "Message to echo"
        in: body
        name: message
        required: true
        schema:
          $ref: "#/definitions/echoMessage"   
definitions:
  echoMessage:
    properties:
      message:
        type: "string"
  searchMessage:
    properties:
      message:
        type: "string"

最佳答案

您收到 403 错误，这意味着您的预检请求缺少通过访问控制检查的适当身份验证。

在这种情况下，请求前往的资源的 CORS 配置应包含一个 Access-Control-Allow-Origin header 。此 header 应包含允许访问资源的所有 HTTP 来源。

以防万一，您应该添加一个或多个 Access-Control-Request-Header header ，其值必须与 CORS 配置中的 ResponseHeader 值匹配。 Access-Control-Request-Header 中的所有 header 都应出现在 CORS 配置中的 Access-Control-Allow-Origin header 中，以便可以授权请求。

您可以找到有关正确身份验证的更多信息 here .

关于jquery - Gorilla Mux Google Cloud 端点 CORS 问题，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/48466261/