响应中的'Access-Control-Allow-Credentials'标题是''，必须是'true'

我正在使用节点，expression在后端和angular4在客户端，这给我下面的错误：

XMLHttpRequest无法加载http：// localhost：4876 / login / check 。 对预检请求的响应不通过访问控制检查：响应中的“访问控制 – 允许 – 凭证”标头的值为“'，当请求的凭证模式为”包含“时，该值必须为”真“。 原因' http：// localhost：4200 '因此不被允许访问。 由XMLHttpRequest发起的请求的凭证模式由withCredentials属性控制。

用于login/检查的Api实现如下：

router.get('/login/check', (req: any, res: any) => { let api = new ApiConnection(req, res); let accessCard: IAccessCard = api.getContent(Auth.ACCESS_CARD_KEY); if(!Auth.isValid(accessCard)) return api.response.error(); ChatBox.auth.isExpired(accessCard, function (err:any, isExpired: boolean) { if (err) return api.response.error(); if(!isExpired) { api.cookie("AccessCard", accessCard); api.response.success(accessCard); } else { api.response.error(); } }) }); 

路由器的定义是const router = require('express').Router()

为标题和cors设置中间件如下：

 export class Application { private app:any = express(); constructor() { this.setCors(); this.setHeaders(); } public getApp():any { return this.app; } private setCors(){ let whitelist = ['http://localhost:4200','http://localhost:80']; let corsOptions = { origin: (origin:any, callback:any)=>{ if (whitelist.indexOf(origin) !== -1) { callback(null, true) } else { callback(new Error('Not allowed by CORS')) } } } this.app.use(cors(corsOptions)); } private setHeaders() { this.app.use(function (req:any, res:any, next: any) { // Website you wish to allow to connect //res.setHeader('Access-Control-Allow-Origin', Config.WEB_APP_HOST); res.setHeader('Access-Control-Allow-Origin', 'http://localhost:4200'); // Request methods you wish to allow res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE'); // Request headers you wish to allow res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With, content-type'); // Set to true if you need the website to include cookies in the requests sent // to the API (eg in case you use sessions) res.setHeader('Access-Control-Allow-Credentials', true); // Pass to next layer of middleware next(); }); } } 

在客户端，我使用Api如下：

 public startSession(callback: (status: boolean, result: any) => void ) { let self: ChatBox = this; /** * @res.result: IAccessCard */ this.mApiConnection.get(Api.root+'/login/check', (res: any) => { if (res.status == ResponseStatus.SUCCESS) { self.mStorage.storeAccessCard(res.result); self.loadAccount(res.result); } callback(res.status, res.result); }) } 

Answer 1

当在corsOptions中设置cors时，我添加了value credentials，它的工作原理如下：

 private setCors(){ let whitelist = ['http://localhost:4200','http://localhost:80']; let corsOptions = { origin: (origin:any, callback:any)=>{ if (whitelist.indexOf(origin) !== -1) { callback(null, true) } else { callback(new Error('Not allowed by CORS')) } },credentials: true } this.app.use(cors(corsOptions)); }