CROS OPTIONS跨域如何实现？

Question

看了看网上关于CROS的，大概明白非简单请求的流程。先Options请求，然后协商成功后，在正式请求。 怎么搞都搞不定。。。做一次伸手党了我是在header里自定义了两个值做校验。 浏览器就报下面的跨域问题。。。 已拦截跨源请求：同源策略禁止读取位于 http://111.231.56.227:12084/monitor/detailMission 的远程资源。（原因：来自 CORS 预检通道的 CORS 头 'Access-Control-Allow-Headers' 的令牌 'appid' 无效）。 JS代码 var form = new FormData(); form.append("mission_id", "245d14793c0e4f4fa936755cd558841a"); var settings = { "async": true, "crossDomain": true, "url": "http://111.231.56.227:12084/monitor/detailMission", "method": "POST", "headers": { "appId": "0000815", "appSecret": "cbd88ab8822fa", }, "processData": false, "contentType": false, "mimeType": "multipart/form-data", "data": form }; $.ajax(settings).done(function (response) { console.log(response); }); PHP Action header('Content-type: application/json'); header('Access-Control-Allow-Origin:*'); if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS'){ header('Access-Control-Allow-Methods:POST'); header('Access-Control-Allow-Headers:*'); header('Access-Control-Mas-Age:3600'); $this->returnSuccess(); } $this->checkAppIdAndSecret(); $id = $this->getPost('mission_id'); 大家说headers不能用*，因此改了一下 header("Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, appid, appSecret"); Methods也加上OPTIOHS，GET，PUT啥的了换了个报错

Answer 1

Support for wildcards in the Access-Control-Allow-Headers header was added to the living standard only in May 2016, so it may not be supported by all browsers.

Access-Control-Allow-Headers不接受通配符。

cors-access-control-allow-headers-wildcard-being-ignored

补充

注意拼写错误，响应允许的是appSecert，请求发送的是appSecret。

Answer 2

你后端header 没有允许 appid, appSecret。
PHP 添加

header("Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, appid, appSecret");

Answer 3

看了下MDN ，上面没有说Access-Control-Allow-Headers 可以用 *

Answer 4

Access-Control-Allow-Methods得把options加上噻