strict-origin-when-cross-origin 403 exception resolution

background

A service has just been launched. Other customers need to call the service across domains. After several attempts, the call was finally successful. This article solves the cross-domain processing in the case of nginx + spring boot + juery

The operation is as follows

Use nginx to configure the following:

server {
        listen 80;
        server_name xxx.com;
		location /data/ {
			proxy_pass 转发地址;
			proxy_set_header X-Real-IP $remote_addr;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			add_header Access-Control-Allow-Origin *;
			add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
			add_header Access-Control-Allow-Headers X-Requested-With;
			add_header Access-Control-Max-Age 60000;
			add_header Access-Control-Allow-Credentials true
		 }
}

Under normal circumstances, the above configuration can complete the cross-domain configuration of the service. Since I am processing it in jquery language, there is the following exception:

jquery request

$.ajax({
  	type : "POST",
    url : "请求地址",
    dataType: "json",
    data : param,
    contentType:"application/json;charset=utf-8",
    success : function(data) {
       alert("成功");
    }
});

operation result

Insert image description here
Insert image description here

describe

We noticed that the request failed here, and there were two requests at the same time, one for the OPTIONS method and one for the referrer policy: strict-origin-when-cross-origin. It means that the correct response result cannot be obtained because the OPTIONS request failed.

deal with

Continue to modify the following content in the nginx configuration file to make the OPTIONS request successful.

server {
	 listen 80;
     server_name xxx.com;
	 location /data/ {
		proxy_pass 转发地址;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		add_header Access-Control-Allow-Origin *;
		add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
		add_header Access-Control-Allow-Headers X-Requested-With;
		add_header Access-Control-Max-Age 60000;
		add_header Access-Control-Allow-Credentials true;
		if ( $request_method = OPTIONS ){
			return 200;
		}
	 }
}

Guess you like

Origin blog.csdn.net/qq_36378416/article/details/129981845
403