Zend Framework 2 - 如何允许杀死CORS策略：没有'Access-Control-Allow-Origin'

Question

我申请了以下但谷歌浏览器不断显示我的错误。

已被CORS策略阻止：请求的资源上没有“Access-Control-Allow-Origin”标头。因此不允许原点'null'访问。

  public function checkAction() {
    // responsible to send back JSON object
    header('Access-Control-Allow-Origin: *');
    $response = $this->getResponse();
    //$response->setHeader('Access-Control-Allow-Origin', '*');

    $json = array(
     'result' => 'ok',
     'module' => 'ajax',
     'data' => 'test'
   );

   $response->setContent(Json::encode($json));
   return $response;
   exit;
 }

注意：前端：www.javascript.com使用ajax进入后端：www.backend-zendframework.com/rr/check

Answer 1

作品。

只有在httpd.conf中添加以下行才能工作。

  Header always set Access-Control-Allow-Headers "*"
  Header always set Access-Control-Allow-Origin "https://www.stackoverflow.com"
  Header always set Access-Control-Allow-Credentials "true"

永远不会使用以下ZF2的愚蠢行：

$response->getHeaders()->addHeaderLine('Access-Control-Allow-Origin', 'https://www.stackoverflow.com');
$response->getHeaders()->addHeaderLine('Access-Control-Allow-Credentials', 'true');
$response->getHeaders()->addHeaderLine('Access-Control-Allow-Methods', 'POST PUT DELETE GET');
$response->setStatusCode(200);