blocks|key|2942041|text|您尝试设置的标头是响应标头。它们必须在响应中由您向其发出请求的服务器提供。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|2942042|它们在客户端上没有被设置的位置。如果权限可以由需要权限的站点而不是拥有数据的站点授予，那么授予权限的方法将是毫无意义的。|2942043|entityMap^0|9|2|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|M|8|@]|D|@]|E|$]]|$1|H|3|-4|5|6|7|N|8|@]|D|@]|E|$]]]|I|$]]

The headers you are trying to set are response headers. They have to be provided, in the response, by the server you are making the request to. 

They have no place being set on the client. It would be pointless having a means to grant permissions if they could be granted by the site that wanted permission instead of the site that owned the data.

blocks|key|150062|text|服务器(+POST请求被发送到的目标)需要在其响应中包含Access-Control-Allow-Headers标头(etc)+。将它们放入客户端的请求中不会产生任何效果。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|CODE|entityRanges|data|150063|这是因为它由服务器来指定它接受跨域请求(并且它允许Content-Type请求头，等等)-客户端不能自己决定给定的服务器应该允许CORS。|150064|entityMap^0|0|3|1S|M|S|S|0|0|1X|P|C|0^^$0|@$1|2|3|4|5|6|7|K|8|@$9|L|A|M|B|C]|$9|N|A|O|B|C]|$9|P|A|Q|B|D]]|E|@]|F|$]]|$1|G|3|H|5|6|7|R|8|@$9|S|A|T|B|C]|$9|U|A|V|B|D]]|E|@]|F|$]]|$1|I|3|-4|5|6|7|W|8|@]|E|@]|F|$]]]|J|$]]

The server (that the POST request is sent to) needs to include the <code>Access-Control-Allow-Headers</code> header (etc) in its response. Putting them in your request from the client has no effect.

This is because it is up to the server to specify that it accepts cross-origin requests (and that it permits the <code>Content-Type</code> request header, and so on) – the client cannot decide for itself that a given server should allow CORS.

blocks|key|2942177|text|服务器(+POST请求被发送到的服务器)需要在其响应中包含Content-Type头。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|2942178|下面是要包含的典型标头列表，其中包括一个自定义的"X_ACCESS_TOKEN“标头：|2942179|"X-ACCESS_TOKEN",+"Access-Control-Allow-Origin",+"Authorization",+"Origin",+"x-requested-with",+"Content-Type",+"Content-Range",+"Content-Disposition",+"Content-Description"|code-block|syntax|javascript|2942180|这就是你的http服务器工程师需要为你发送请求的web服务器配置的东西。|2942181|您可能还想让您的服务器人员公开"Content-Length“头。|2942182|他会认识到这是一个跨域资源共享(CORS)请求，并且应该理解进行这些服务器配置的含义。|2942183|有关详情，请参阅：|2942184|2942185|http://www.w3.org/TR/cors/|unordered-list-item|2942186|http://enable-cors.org/|2942187|2942188|entityMap|0|LINK|mutability|MUTABLE|url|1^0|T|C|0|0|0|0|0|0|0|0|0|Q|0|0|0|N|1|0|0^^$0|@$1|2|3|4|5|6|7|19|8|@$9|1A|A|1B|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|1C|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|1D|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|1E|8|@]|D|@]|E|$]]|$1|O|3|P|5|6|7|1F|8|@]|D|@]|E|$]]|$1|Q|3|R|5|6|7|1G|8|@]|D|@]|E|$]]|$1|S|3|T|5|6|7|1H|8|@]|D|@]|E|$]]|$1|U|3|-4|5|6|7|1I|8|@]|D|@]|E|$]]|$1|V|3|W|5|X|7|1J|8|@]|D|@$9|1K|A|1L|1|1M]]|E|$]]|$1|Y|3|Z|5|X|7|1N|8|@]|D|@$9|1O|A|1P|1|1Q]]|E|$]]|$1|10|3|-4|5|6|7|1R|8|@]|D|@]|E|$]]|$1|11|3|-4|5|6|7|1S|8|@]|D|@]|E|$]]]|12|$13|$5|14|15|16|E|$17|W]]|18|$5|14|15|16|E|$17|Z]]]]

The server (that the POST request is sent to) needs to include the Content-Type header in its response.

Here's a list of typical headers to include, including one custom "X_ACCESS_TOKEN" header:

<pre><code>"X-ACCESS_TOKEN", "Access-Control-Allow-Origin", "Authorization", "Origin", "x-requested-with", "Content-Type", "Content-Range", "Content-Disposition", "Content-Description"
</code></pre>

That's what your http server guy needs to configure for the web server that you're sending your requests to.

You may also want to ask your server guy to expose the "Content-Length" header.

He'll recognize this as a Cross-Origin Resource Sharing (CORS) request and should understand the implications of making those server configurations.

For details see:

<ul>
<li><a href="http://www.w3.org/TR/cors/">http://www.w3.org/TR/cors/</a></li>
<li><a href="http://enable-cors.org/">http://enable-cors.org/</a></li>
</ul>

blocks|key|147373|text|我也有同样的问题。我发现的In+the+jQuery+documentation：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|147374|147375|对于跨域请求，将内容类型设置为application/x-www-form-urlencoded、multipart/form-data或text/plain以外的任何值都会触发浏览器向服务器发送印前检查选项请求。|blockquote|style|CODE|147376|147377|147378|因此，虽然服务端允许跨域请求，但不允许Access-Control-Allow-Headers，但会抛出错误。默认情况下，angular内容类型是application/json，它试图发送OPTION请求。尝试覆盖angular默认标头或在服务器端允许Access-Control-Allow-Headers。下面是一个angular示例：|147379|$http.post(url,+data,+{
++++headers+:+{
++++++++'Content-Type'+:+'application/x-www-form-urlencoded;+charset=UTF-8'
++++}
});|code-block|syntax|javascript|147380|entityMap|0|LINK|mutability|MUTABLE|url|http://api.jquery.com/jquery.ajax/^0|D|R|0|0|0|F|X|1D|J|1X|A|0|0|0|J|S|21|G|3J|S|0|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@$A|11|B|12|1|13]]|C|$]]|$1|D|3|-4|5|6|7|14|8|@]|9|@]|C|$]]|$1|E|3|F|5|G|7|15|8|@$A|16|B|17|H|I]|$A|18|B|19|H|I]|$A|1A|B|1B|H|I]]|9|@]|C|$]]|$1|J|3|-4|5|6|7|1C|8|@]|9|@]|C|$]]|$1|K|3|-4|5|6|7|1D|8|@]|9|@]|C|$]]|$1|L|3|M|5|6|7|1E|8|@$A|1F|B|1G|H|I]|$A|1H|B|1I|H|I]|$A|1J|B|1K|H|I]]|9|@]|C|$]]|$1|N|3|O|5|P|7|1L|8|@]|9|@]|C|$Q|R]]|$1|S|3|-4|5|6|7|1M|8|@]|9|@]|C|$]]]|T|$U|$5|V|W|X|C|$Y|Z]]]]

I had the same problem. <a href="http://api.jquery.com/jquery.ajax/" rel="noreferrer">In the jQuery documentation</a> I found:

<blockquote>
 For cross-domain requests, setting the content type to anything other than <code>application/x-www-form-urlencoded</code>, <code>multipart/form-data</code>, or <code>text/plain</code> will trigger the browser to send a preflight OPTIONS request to the server.
</blockquote>

So though the server allows cross origin request but does not allow <code>Access-Control-Allow-Headers</code> , it will throw errors. By default angular content type is <code>application/json</code>, which is trying to send a OPTION request. Try to overwrite angular default header or allow <code>Access-Control-Allow-Headers</code> in server end. Here is an angular sample:

<pre><code>$http.post(url, data, {
 headers : {
 'Content-Type' : 'application/x-www-form-urlencoded; charset=UTF-8'
 }
});
</code></pre>

blocks|key|148644|text|如果这对任何人都有帮助，(即使这有点糟糕，因为我们必须只允许它用于开发目的)，这里有一个Java解决方案，因为我遇到了同样的问题。编辑不要使用通配符，因为这是一个糟糕的解决方案，如果你真的需要在本地运行一些东西，请使用localhost。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|148645|public+class+SimpleCORSFilter+implements+Filter+{

public+void+doFilter(ServletRequest+req,+ServletResponse+res,+FilterChain+chain)+throws+IOException,+ServletException+{
++++HttpServletResponse+response+=+(HttpServletResponse)+res;
++++response.setHeader("Access-Control-Allow-Origin",+"my-authorized-proxy-or-domain");
++++response.setHeader("Access-Control-Allow-Methods",+"POST,+GET");
++++response.setHeader("Access-Control-Max-Age",+"3600");
++++response.setHeader("Access-Control-Allow-Headers",+"Content-Type,+Access-Control-Allow-Headers,+Authorization,+X-Requested-With");
++++chain.doFilter(req,+res);
}

public+void+init(FilterConfig+filterConfig)+{}

public+void+destroy()+{}

}|code-block|syntax|javascript|148646|entityMap^0|31|9|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|P|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|L|$]]

If that helps anyone, (even if this is kind of poor as we must only allow this for dev purpose) here is a Java solution as I encountered the same issue.
[Edit] Do not use the wild card * as it is a bad solution, use <code>localhost</code> if you really need to have something working locally.

<pre><code>public class SimpleCORSFilter implements Filter {

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
 HttpServletResponse response = (HttpServletResponse) res;
 response.setHeader("Access-Control-Allow-Origin", "my-authorized-proxy-or-domain");
 response.setHeader("Access-Control-Allow-Methods", "POST, GET");
 response.setHeader("Access-Control-Max-Age", "3600");
 response.setHeader("Access-Control-Allow-Headers", "Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With");
 chain.doFilter(req, res);
}

public void init(FilterConfig filterConfig) {}

public void destroy() {}

}
</code></pre>

blocks|key|150149|text|以下内容适用于我的nodejs：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|150150|xServer.use(function(req,+res,+next)+{
++res.setHeader("Access-Control-Allow-Origin",+'http://localhost:8080');
++res.setHeader('Access-Control-Allow-Methods',+'POST,GET,OPTIONS,PUT,DELETE');
++res.setHeader('Access-Control-Allow-Headers',+'Content-Type,Accept');

++next();
});|code-block|syntax|javascript|150151|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

The following works for me with nodejs:

<pre><code>xServer.use(function(req, res, next) {
 res.setHeader("Access-Control-Allow-Origin", 'http://localhost:8080');
 res.setHeader('Access-Control-Allow-Methods', 'POST,GET,OPTIONS,PUT,DELETE');
 res.setHeader('Access-Control-Allow-Headers', 'Content-Type,Accept');

 next();
});
</code></pre>

blocks|key|2942263|text|在我的例子中，我在web服务方法中接收了几个参数@HeaderParam。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2942264|这些参数必须以这种方式在CORS过滤器中声明：|2942265|@Provider
public+class+CORSFilter+implements+ContainerResponseFilter+{

++++@Override
++++public+void+filter(ContainerRequestContext+requestContext,+ContainerResponseContext+responseContext)+throws+IOException+{

++++++++MultivaluedMap<String,+Object>+headers+=+responseContext.getHeaders();

++++++++headers.add("Access-Control-Allow-Origin",+"*");
++++++++...
++++++++headers.add("Access-Control-Allow-Headers",+
++++++++/*
+++++++++*+name+of+the+@HeaderParam("name")+must+be+declared+here+(raw+String):
+++++++++*/
++++++++"name",+...);
++++++++headers.add("Access-Control-Allow-Credentials",+"true");
++++++++headers.add("Access-Control-Allow-Methods",+"GET,+POST,+PUT,+DELETE,+OPTIONS,+HEAD");+++
++++}
}|code-block|syntax|javascript|2942266|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

In my case, I'm receiving several parameters as @HeaderParam into a web service method.

These parameters MUST be declared in your CORS filter that way:

<pre><code>@Provider
public class CORSFilter implements ContainerResponseFilter {

 @Override
 public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) throws IOException {

 MultivaluedMap&lt;String, Object&gt; headers = responseContext.getHeaders();

 headers.add("Access-Control-Allow-Origin", "*");
 ...
 headers.add("Access-Control-Allow-Headers", 
 /*
 * name of the @HeaderParam("name") must be declared here (raw String):
 */
 "name", ...);
 headers.add("Access-Control-Allow-Credentials", "true");
 headers.add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, HEAD"); 
 }
}
</code></pre>

blocks|key|2729842|text|如果任何人在使用express服务器时遇到此问题，请添加以下中间件|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2729843|app.use(function(req,+res,+next)+{
++res.header("Access-Control-Allow-Headers",+"Origin,+X-Requested-With,+Content-Type,+Accept");
++next();
});|code-block|syntax|javascript|2729844|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

If anyone experiences this problem with an express server, add the following middleware 

<pre><code>app.use(function(req, res, next) {
 res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
 next();
});
</code></pre>

blocks|key|151311|text|如果你在pc或mac上的chrome上测试一些ionic2或angularjs2的javascript请求，那么请确保你为chrome浏览器安装了CORS插件以允许跨源。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|151312|mayba+get请求可以在不需要的情况下工作，但是post和but和delete将需要你安装cors插件来测试没有问题，这肯定不酷，但我不知道没有CORS插件的人是怎么做的。|151313|还要确保json响应不会通过某些json状态返回400。|151314|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

if you testing some javascript requests for ionic2 or angularjs 2 , in your chrome on pc or mac , then be sure that you install CORS plugin for chrome browser to allow cross origin . 

mayba get requests will work without needing that , but post and puts and delete will need you to install cors plugin for testing to go without problems , that definitley not cool , but i do not know how people do it without CORS plugin . 

and also be sure the json response is not returning 400 by some json status

blocks|key|2942292|text|这是后端问题。如果在后端使用sails+api，请更改cors.js并在此处添加您的文件|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2942293|module.exports.cors+=+{
++allRoutes:+true,
++origin:+'*',
++credentials:+true,
++methods:+'GET,+POST,+PUT,+DELETE,+OPTIONS,+HEAD',
++headers:+'Origin,+X-Requested-With,+Content-Type,+Accept,+Engaged-Auth-Token'
};|code-block|syntax|javascript|2942294|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

this is backend problem. if use sails api on backend change cors.js and add your filed here

<pre><code>module.exports.cors = {
 allRoutes: true,
 origin: '*',
 credentials: true,
 methods: 'GET, POST, PUT, DELETE, OPTIONS, HEAD',
 headers: 'Origin, X-Requested-With, Content-Type, Accept, Engaged-Auth-Token'
};
</code></pre>

blocks|key|2729882|text|Request+header+field+Access-Control-Allow-Origin+is+not+allowed+by+Access-Control-Allow-Headers错误表示响应未处理或不允许HTTP头部的Access-Control-Allow-Origin字段。移除请求头部中的Access-Control-Allow-Origin字段。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2729883|entityMap^0|0|2N|37|R|49|R|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]|$9|K|A|L|B|C]|$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|O|8|@]|D|@]|E|$]]]|G|$]]

<code>Request header field Access-Control-Allow-Origin is not allowed by Access-Control-Allow-Headers</code> error
means that <code>Access-Control-Allow-Origin</code> field of HTTP header is not handled or allowed by response. Remove <code>Access-Control-Allow-Origin</code> field from the request header.

blocks|key|2942299|text|您可以使用以下命令在PHP中激活适当的头文件：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2942300|header('Access-Control-Allow-Origin:+*');
header("Access-Control-Allow-Methods:+GET,+POST,+OPTIONS,+PUT,+DELETE");
header("Access-Control-Allow-Headers:+Content-Type,+Access-Control-Allow-Headers,+X-Requested-With");|code-block|syntax|javascript|2942301|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

You can activate the proper header in PHP with this:

<pre><code>header('Access-Control-Allow-Origin: *');
header("Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE");
header("Access-Control-Allow-Headers: Content-Type, Access-Control-Allow-Headers, X-Requested-With");
</code></pre>

blocks|key|151326|text|在Asp+Net核心中，快速将其用于开发；在Startup.cs中，Configure+method添加|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|CODE|entityRanges|data|151327|app.UseCors(options+=>+options.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader());|code-block|syntax|javascript|151328|entityMap^0|1|9|M|A|Y|G|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]|$9|Q|A|R|B|D]|$9|S|A|T|B|D]]|E|@]|F|$]]|$1|G|3|H|5|I|7|U|8|@]|E|@]|F|$J|K]]|$1|L|3|-4|5|6|7|V|8|@]|E|@]|F|$]]]|M|$]]

In Asp Net Core, to quickly get it working for development; in <code>Startup.cs</code>, <code>Configure method</code> add

<pre><code>app.UseCors(options =&gt; options.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader());
</code></pre>

blocks|key|151330|text|如果你使用localhost和PHP来解决这个问题：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|151331|header('Access-Control-Allow-Origin:+*');
header('Access-Control-Allow-Headers:+Content-Type');+|code-block|syntax|javascript|151332|从您的前端使用：|151333|{headers:+{"Content-Type":+"application/json"}}|151334|而且不再有来自localhost的问题了！|151335|entityMap^0|5|9|0|0|0|0|7|9|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|V|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|W|8|@]|D|@]|E|$]]|$1|M|3|N|5|H|7|X|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|Y|8|@$9|Z|A|10|B|C]]|D|@]|E|$]]|$1|Q|3|-4|5|6|7|11|8|@]|D|@]|E|$]]]|R|$]]

If you are using <code>localhost</code> and PHP set to this to solve the issue:

<pre><code>header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Headers: Content-Type'); 
</code></pre>

From your front-end use:

<pre><code>{headers: {"Content-Type": "application/json"}}
</code></pre>

and boom no more issues from <code>localhost</code>!

blocks|key|148695|text|对于我，我在服务器的web.config文件中添加了以下内容：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|148696|<system.webServer>
++++<httpProtocol>
++++++++<customHeaders>
++++++++++++<add+name="Access-Control-Allow-Origin"+value="https://other.domain.com"+/>
++++++++++++<add+name="Access-Control-Allow-Methods"+value="GET,POST,OPTIONS,PUT,DELETE"+/>
++++++++++++<add+name="Access-Control-Allow-Headers"+value="Content-Type,X-Requested-With"+/>
++++++++</customHeaders>
++++</httpProtocol>
<system.webServer>|code-block|syntax|javascript|148697|entityMap^0|A|A|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|P|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|L|$]]

For me, Added the following to my server's <code>web.config</code> file:
<pre><code>&lt;system.webServer&gt;
 &lt;httpProtocol&gt;
 &lt;customHeaders&gt;
 &lt;add name=&quot;Access-Control-Allow-Origin&quot; value=&quot;https://other.domain.com&quot; /&gt;
 &lt;add name=&quot;Access-Control-Allow-Methods&quot; value=&quot;GET,POST,OPTIONS,PUT,DELETE&quot; /&gt;
 &lt;add name=&quot;Access-Control-Allow-Headers&quot; value=&quot;Content-Type,X-Requested-With&quot; /&gt;
 &lt;/customHeaders&gt;
 &lt;/httpProtocol&gt;
&lt;system.webServer&gt;
</code></pre>

blocks|key|2729975|text|对于我来说，我在web.config中使用了通配符"*"+Access-Control-Allow-Headers|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2729976|<add+name="Access-Control-Allow-Headers"+value="*"+/>|code-block|syntax|javascript|2729977|此解决方案适用于大多数浏览器，但不适用于Safari或IE|BOLD|2729978|​|2729979|📷|atomic|2729980|2729981|事实证明，解决方案是手动将所有自定义标头添加到web.config中|2729982|<system.webServer>
++++<httpProtocol>
++++++++<customHeaders>
++++++++++++<add+name="Access-Control-Allow-Origin"+value="https://somedomain.com"+/>
++++++++++++<add+name="Access-Control-Allow-Methods"+value="GET,POST,OPTIONS,PUT,DELETE"+/>
++++++++++++<add+name="Access-Control-Allow-Headers"+value="custom-header1,+custome-header2,+custome-header3"+/>
++++++++</customHeaders>
++++</httpProtocol>
<system.webServer>|2729983|entityMap|0|LINK|mutability|MUTABLE|url|https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers|1|IMAGE|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/9ab4ab67f5da8ddd3c8e67e4ced7fae8.png|imageAlt^0|8|A|P|3|T|S|0|0|0|E|F|0|0|0|1|1|0|0|N|A|0|0^^$0|@$1|2|3|4|5|6|7|1B|8|@$9|1C|A|1D|B|C]|$9|1E|A|1F|B|C]]|D|@$9|1G|A|1H|1|1I]]|E|$]]|$1|F|3|G|5|H|7|1J|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|1K|8|@$9|1L|A|1M|B|M]]|D|@]|E|$]]|$1|N|3|O|5|6|7|1N|8|@]|D|@]|E|$]]|$1|P|3|Q|5|R|7|1O|8|@]|D|@$9|1P|A|1Q|1|1R]]|E|$]]|$1|S|3|O|5|6|7|1S|8|@]|D|@]|E|$]]|$1|T|3|U|5|6|7|1T|8|@$9|1U|A|1V|B|C]]|D|@]|E|$]]|$1|V|3|W|5|H|7|1W|8|@]|D|@]|E|$I|J]]|$1|X|3|-4|5|6|7|1X|8|@]|D|@]|E|$]]]|Y|$Z|$5|10|11|12|E|$13|14]]|15|$5|16|11|17|E|$18|19|1A|-4]]]]

For me I had wildcard <code>&quot;*&quot;</code> <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers" rel="nofollow noreferrer">Access-Control-Allow-Headers</a> in <code>web.config</code>:
<pre><code>&lt;add name=&quot;Access-Control-Allow-Headers&quot; value=&quot;*&quot; /&gt;
</code></pre>
This solution works for most navigators but not for Safari or IE
<a href="https://i.stack.imgur.com/tiXxd.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/tiXxd.png" alt="Browser compatibility wildcard Access-Control-Allow-Headers" /></a>
It turned out the solution was to add manually all the custom header to the <code>web.config</code>:
<pre class="lang-xml prettyprint-override"><code>&lt;system.webServer&gt;
 &lt;httpProtocol&gt;
 &lt;customHeaders&gt;
 &lt;add name=&quot;Access-Control-Allow-Origin&quot; value=&quot;https://somedomain.com&quot; /&gt;
 &lt;add name=&quot;Access-Control-Allow-Methods&quot; value=&quot;GET,POST,OPTIONS,PUT,DELETE&quot; /&gt;
 &lt;add name=&quot;Access-Control-Allow-Headers&quot; value=&quot;custom-header1, custome-header2, custome-header3&quot; /&gt;
 &lt;/customHeaders&gt;
 &lt;/httpProtocol&gt;
&lt;system.webServer&gt;
</code></pre>

I'm trying to send files to my server with a post request, but when it sends it causes the error:

<blockquote>
 Request header field Content-Type is not allowed by Access-Control-Allow-Headers.
</blockquote>

So I googled the error and added the headers:

<pre><code>$http.post($rootScope.URL, {params: arguments}, {headers: {
 "Access-Control-Allow-Origin" : "*",
 "Access-Control-Allow-Methods" : "GET,POST,PUT,DELETE,OPTIONS",
 "Access-Control-Allow-Headers": "Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With"
}
</code></pre>

Then I get the error: 

<blockquote>
 Request header field Access-Control-Allow-Origin is not allowed by Access-Control-Allow-Headers
</blockquote>

So I googled that and the only similar question I could find was provided a half answer then closed as off topic. What headers am I supposed to add/remove?

Request header field Access-Control-Allow-Headers is not allowed by Access-Control-Allow-Headers

中间件

服务器

Java

我尝试使用post请求将文件发送到我的服务器，但当它发送时会导致错误：Access-Control-Allow- header不允许请求标头字段Content-Type。所以我用谷歌搜索了这个错误，并添加了标题：$http.post($rootScope.URL, {params: arguments}, {heade...

问Access-Control-Allow-Headers不允许请求头部字段Access-Control-Allow-Headers
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Access-Control-Allow-Headers不允许请求头部字段Access-Control-Allow-HeadersEN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Access-Control-Allow-Headers不允许请求头部字段Access-Control-Allow-Headers
EN