我正在使用 angular2 和 yii2 restful 服务但是它失败了

这是我的angular2部分

In the userservice
 constructor(private http:HttpClientService, private _domaindetails:Domaindetails) { }

profile(val:string="profile"):Observable<User>{
return this.http.get(this.getUserUrl(val))
  .map(this.extractData)

 }

这是httpclientService

 createAuthorizationHeader(headers: Headers) {
  let token = JSON.parse(localStorage.getItem("currentUser")).token;
  if (token) {
    headers.append('Authorization', 'Bearer ' + token);
    headers.append('Content-Type', 'application/x-www-form-urlencoded');
    headers.append('Content-Type', 'application/json');
   }

  }

post(url, data) {
  let headers = new Headers();
  this.createAuthorizationHeader(headers);
 return this.http.post(url, data, {
    headers: headers
 });
}

这是我在 Yii2 中的后端

    public function behaviors()
{
    $behaviors = parent::behaviors();
     $behaviors['corsFilter'] = [
        'class' => \yii\filters\Cors::className(),
        'cors' => [
            // restrict access to
            'Origin' => ['http://localhost:4200'],
            'Access-Control-Request-Method' => ['POST', 'GET','PUT'],
            // Allow only POST and PUT methods
            'Access-Control-Request-Headers' => ['*'],
            // Allow only headers 'X-Wsse'
            // 'Access-Control-Allow-Credentials' => true,
            // Allow OPTIONS caching
            'Access-Control-Max-Age' => 3600,
            // Allow the X-Pagination-Current-Page header to be exposed to the browser.
            'Access-Control-Expose-Headers' => ['X-Pagination-Current-Page'],
        ],
    ];

    $auth = $behaviors['authenticator'] = [
        'class' => HttpBearerAuth::className(),
        'only' => ['can-access','profile'],  //access controller
    ];

   $behaviors['authenticator']['except'] = ['options'];
    return $behaviors;
}

yii2 操作失败返回未授权访问错误

 public function actionProfile()
{

    $user = Yii::$app->user->identity;
    return ['data' => $user];
}

当我检查 Yii::$app->request->headers;

如您所见，不记名 token 已设置

这是我的用户模型

   public static function findIdentityByAccessToken($token, $type = null)
{
    return static::findOne(['auth_key' => $token]);  //auth_key is the value used in bearer token
}

为什么它一直返回错误 401 unauthorized access 而当我使用相同的 authkey 值并在 postman 中设置 authorization bearer headers 时它工作正常

经过一些研究，我发现每当 angular2 发出请求时，它都会发送一个失败的选项请求

最佳答案

对于那些可能遇到这个问题的人，我发现这是由 HttpBearerAuth 引起的，当我更改为 QueryParamAuth 时，一切正常，我还进行了一些其他更改，如

ON THE CONTROLLER
1.Removed the cors filters

public function behaviors()
{
    $behaviors = parent::behaviors();

    $behaviors['authenticator'] = [
        'class' => CompositeAuth::className(),
        'authMethods' => [
            HttpBasicAuth::className(),
            HttpBearerAuth::className(),
            QueryParamAuth::className(),
        ],
    ];
    return $behaviors;

}

2,在我的配置main.php中

     'response' => [
        'format' => yii\web\Response::FORMAT_JSON,
        'charset' => 'UTF-8',
        'on beforeSend' => function ($event) {
            header("Access-Control-Allow-Origin: *");
        }
    ],
        'urlManager' => [
        'class' => 'yii\web\UrlManager',
        'enablePrettyUrl' => true,
        'showScriptName' => false,
        'rules' => [
            ['class' => 'yii\rest\UrlRule', 'controller' => 'auth', 'pluralize'=>false],
            ...other controlers here
        ],

    ],

3.在我添加的项目根目录下的.htacess文件中

   Header set Access-Control-Allow-Origin "*"
   Header set Access-Control-Allow-Headers "Content-Type"

所以我的 angular2 post 请求看起来像

http://127.0.0.1/bcl/api/rest/v1/auth/logout?access-token=your access token

因此访问 token 总是作为查询参数传递

主要原因是因为我发现如果浏览器发送除内容类型之外的任何 header ，则会触发选项请求

所以现在我的标题看起来像

headers.append('Content-Type', 'application/x-www-form-urlencoded'); 
//i removed the bearer token

关于php - 在 yii2 rest 中传递 bearer token 返回 401 错误，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/41800905/