blocks|key|4549135|text|试试这个，以确保您正确配置了CORS：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4549136|[EnableCors(origins:+"*",+headers:+"*",+methods:+"*")]|code-block|syntax|javascript|4549137|还是不能工作吗？检查HTTP标头是否存在。|4549138|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Try this, to make sure you configured CORS correctly:

<pre><code>[EnableCors(origins: "*", headers: "*", methods: "*")]
</code></pre>

Still not working? Check HTTP headers presence.

blocks|key|4549177|text|要使任何CORS协议正常工作，您需要在每个端点上使用OPTIONS方法(或使用此方法的全局筛选器)，以返回这些标头：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4549178|Access-Control-Allow-Origin:+*
Access-Control-Allow-Methods:+GET,+POST,+PUT,+DELETE
Access-Control-Allow-Headers:+content-type|code-block|syntax|javascript|4549179|原因是浏览器将首先发送一个OPTIONS请求来“测试”您的服务器并查看授权|4549180|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

To make any CORS protocol to work, you need to have a OPTIONS method on every endpoint (or a global filter with this method) that will return those headers : 

<pre><code>Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-Headers: content-type
</code></pre>

The reason is that the browser will send first an OPTIONS request to 'test' your server and see the authorizations

blocks|key|42380|text|@Mihai-Andrei+Dinculescu的答案是正确的，但为了搜索者的利益，还有一个微妙的点可能会导致这个错误。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|42381|在网址末尾添加'/‘将使EnableCors在所有情况下都无法工作(例如，从主页)。|42382|也就是说，这将不起作用|42383|var+cors+=+new+EnableCorsAttribute("http://testing.azurewebsites.net/",+"*",+"*");
config.EnableCors(cors);|code-block|syntax|javascript|42384|但这将会起作用：|42385|var+cors+=+new+EnableCorsAttribute("http://testing.azurewebsites.net",+"*",+"*");
config.EnableCors(cors);|42386|如果使用EnableCors属性，效果是相同的。|42387|entityMap^0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|T|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|U|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|V|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|W|8|@]|9|@]|A|$]]|$1|M|3|N|5|H|7|X|8|@]|9|@]|A|$I|J]]|$1|O|3|P|5|6|7|Y|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|Z|8|@]|9|@]|A|$]]]|R|$]]

@Mihai-Andrei Dinculescu's answer is correct, but for the benefit of searchers, there is also a subtle point that can cause this error. 

Adding a '/' on the end of your URL will stop EnableCors from working in all instances (e.g. from the homepage).

I.e. This will not work

<pre><code>var cors = new EnableCorsAttribute("http://testing.azurewebsites.net/", "*", "*");
config.EnableCors(cors);
</code></pre>

but this will work:

<pre><code>var cors = new EnableCorsAttribute("http://testing.azurewebsites.net", "*", "*");
config.EnableCors(cors);
</code></pre>

The effect is the same if using the EnableCors Attribute.

blocks|key|4549263|text|这可能是因为安装了Cors+nuget包。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4549264|如果您在从nuget安装和启用cors后遇到此问题，那么您可以尝试重新安装web+Api。|4549265|在包管理器中，运行Update-Package+Microsoft.AspNet.WebApi+-reinstall|offset|length|style|CODE|4549266|entityMap^0|0|0|9|1D|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|M|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|N|8|@$F|O|G|P|H|I]]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|K|$]]

It may be because of the installation of Cors nuget packages.

If you facing the problem after installing and enabaling cors from nuget , then you may try reinstalling web Api.

From the package manager, run <code>Update-Package Microsoft.AspNet.WebApi -reinstall</code>

blocks|key|42494|text|如果您的web.config中有安全\requestFiltering节点，如下所示：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|42495|<security>
++<requestFiltering>
++++<verbs+allowUnlisted="false">
++++++<add+verb="GET"+allowed="true"+/>
++++++<add+verb="POST"+allowed="true"+/>
++++++<add+verb="PUT"+allowed="true"+/>
++++++<add+verb="DELETE"+allowed="true"+/>
++++++<add+verb="DEBUG"+allowed="true"+/>++++++++++
++++</verbs>
++</requestFiltering>|code-block|syntax|javascript|42496|确保你也添加了这个|42497|<add+verb="OPTIONS"+allowed="true"+/>|42498|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

If you have security\requestFiltering nodes in your web.config as follows:

<pre><code>&lt;security&gt;
 &lt;requestFiltering&gt;
 &lt;verbs allowUnlisted="false"&gt;
 &lt;add verb="GET" allowed="true" /&gt;
 &lt;add verb="POST" allowed="true" /&gt;
 &lt;add verb="PUT" allowed="true" /&gt;
 &lt;add verb="DELETE" allowed="true" /&gt;
 &lt;add verb="DEBUG" allowed="true" /&gt; 
 &lt;/verbs&gt;
 &lt;/requestFiltering&gt;
</code></pre>

make sure you add this as well

<pre><code>&lt;add verb="OPTIONS" allowed="true" /&gt;
</code></pre>

blocks|key|42566|text|我知道我来得太晚了。然而，对于任何正在搜索的人来说，我想我应该发布最终对我有效的东西。我并不是说这是最好的解决方案--只是它起作用了。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|42567|我们的WebApi服务使用config.EnableCors(corsAttribute)方法。然而，即使这样，它仍然会在飞行前请求上失败。@Mihai-Andrei+Dinculescu的回答为我提供了线索。首先，我添加了他的Application_BeginRequest()代码来刷新options请求。这对我来说还是不起作用。问题是WebAPI仍然没有向OPTIONS请求添加任何预期的标头。单独冲洗它是行不通的--但它给了我一个想法。我将自定义标头添加到OPTIONS请求的响应中，否则这些标头将通过web.config添加。下面是我的代码：|42568|protected+void+Application_BeginRequest()
{
++if+(Request.Headers.AllKeys.Contains("Origin")+&&+Request.HttpMethod+==+"OPTIONS")
++{
++++Response.Headers.Add("Access-Control-Allow-Origin",+"https://localhost:44343");
++++Response.Headers.Add("Access-Control-Allow-Headers",
++++++"Content-Type,+Access-Control-Allow-Headers,+Authorization,+X-Requested-With");
++++Response.Headers.Add("Access-Control-Allow-Methods",+"GET,+POST,+PUT,+DELETE,+OPTIONS");
++++Response.Headers.Add("Access-Control-Allow-Credentials",+"true");
++++Response.Flush();
++}
}|code-block|syntax|javascript|42569|显然，这只适用于OPTIONS请求。所有其他谓词都由CORS配置处理。如果有更好的办法，我洗耳恭听。对我来说，这感觉像是作弊，我更希望标题是自动添加的，但这最终是有效的，并允许我继续前进。|42570|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|O|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|P|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

I know I'm coming to this very late. However, for anyone who's searching, I thought I'd publish what FINALLY worked for me. I'm not claiming it's the best solution - only that it worked. 

Our WebApi service uses the config.EnableCors(corsAttribute) method. However, even with that, it would still fail on the pre-flight requests. @Mihai-Andrei Dinculescu's answer provided the clue for me. First of all, I added his Application_BeginRequest() code to flush the options requests. That STILL didn't work for me. The issue is that WebAPI still wasn't adding any of the expected headers to the OPTIONS request. Flushing it alone didn't work - but it gave me an idea. I added the custom headers that would otherwise be added via the web.config to the response for the OPTIONS request. Here's my code:

<pre><code>protected void Application_BeginRequest()
{
 if (Request.Headers.AllKeys.Contains("Origin") &amp;&amp; Request.HttpMethod == "OPTIONS")
 {
 Response.Headers.Add("Access-Control-Allow-Origin", "https://localhost:44343");
 Response.Headers.Add("Access-Control-Allow-Headers",
 "Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With");
 Response.Headers.Add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
 Response.Headers.Add("Access-Control-Allow-Credentials", "true");
 Response.Flush();
 }
}
</code></pre>

Obviously, this only applies to the OPTIONS requests. All other verbs are handled by the CORS configuration. If there's a better approach to this, I'm all ears. It feels like a cheat to me and I would prefer if the headers were added automatically, but this is what finally worked and allowed me to move on.

blocks|key|42621|text|我知道人们一开始可能会发现这一点非常明显，但仔细想想这一点。如果你做错了什么，这种情况经常会发生。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|42622|例如，我遇到过这个问题，因为我没有在hosts文件中添加host条目。真正的问题是DNS解析。或者我只是把基本URL弄错了。|42623|有时，如果身份令牌来自一台服务器，但我正在尝试在另一台服务器上使用它，我会收到此错误。|42624|如果你弄错了资源，有时你会得到这个错误。|42625|如果您将CORS中间件放在链中太晚，您可能会得到这个结果。|42626|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|M|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|N|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|O|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|P|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|K|$]]

I know that people will probably find this very obvious at first, but really think about this. This can often happen if you've done something wrong. 

For instance, I've had this problem because I didn't add a host entry to my hosts file. The real problem was DNS resolution. Or I just got the base URL wrong.

Sometimes I get this error if the identity token came from one server, but I'm trying to use it on another.

Sometimes you'll get this error if you've got the resource wrong.

You might get this if you put the CORS middleware too late in the chain.

blocks|key|42670|text|当您尝试从不同的域或不同的端口进行访问时，就会出现此问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|42671|如果你使用的是Visual+Studio，那么进入工具>+NuGet包管理器>包管理器控制台。在那里，您必须安装NuGet包Microsoft.AspNet.WebApi.Cors|offset|length|42672|Install-Package+Microsoft.AspNet.WebApi.Cors|code-block|syntax|javascript|42673|然后，在项目>+App_Start+>+WebApiConfig中启用CORS|42674|public+static+class+WebApiConfig
{
++++public+static+void+Register(HttpConfiguration+config)
++++{
++++++++
++++++++//Enable+CORS.+Note+that+the+domain+doesn't+have+/+in+the+end.
++++++++config.EnableCors(new+EnableCorsAttribute("https://tiagoperes.eu",headers:"*",methods:"*"));

++++++++....

++++}
}|42675|成功安装后，构建解决方案，这应该就足够了|42676|entityMap|0|LINK|mutability|MUTABLE|url|https://www.nuget.org/packages/Microsoft.AspNet.WebApi.Cors^0|0|1Q|S|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Z|8|@]|9|@$D|10|E|11|1|12]]|A|$]]|$1|F|3|G|5|H|7|13|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|14|8|@]|9|@]|A|$]]|$1|M|3|N|5|H|7|15|8|@]|9|@]|A|$I|J]]|$1|O|3|P|5|6|7|16|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|17|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X]]]]

That problem happens when you try to access from a different domain or different port.
If you're using Visual Studio, then go to Tools &gt; NuGet Package Manager &gt; Package Manager Console. There you have to install the NuGet Package <a href="https://www.nuget.org/packages/Microsoft.AspNet.WebApi.Cors" rel="nofollow noreferrer">Microsoft.AspNet.WebApi.Cors</a>
<pre><code>Install-Package Microsoft.AspNet.WebApi.Cors
</code></pre>
Then, in PROJECT &gt; App_Start &gt; WebApiConfig, enable CORS
<pre><code>public static class WebApiConfig
{
 public static void Register(HttpConfiguration config)
 {
 
 //Enable CORS. Note that the domain doesn't have / in the end.
 config.EnableCors(new EnableCorsAttribute(&quot;https://tiagoperes.eu&quot;,headers:&quot;*&quot;,methods:&quot;*&quot;));

 ....

 }
}
</code></pre>
Once installed successfully, build the solution and that should suffice

blocks|key|42724|text|对于那些只是在.NET+5中创建Web+API而不是Web+App的人来说，在Startup.cs中您需要这样配置您的策略：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|42725|public+void+ConfigureServices(IServiceCollection+services)
{
++++//+Additional+configs+above...
++++services.AddCors(options+=>
++++{
++++++++options.AddPolicy("AllowAnyOrigin",+builder+=>
++++++++{
++++++++++++//+Allow+"Access-Control-Allow-Origin:+*"+header
++++++++++++builder.AllowAnyOrigin();
++++++++});
++++});
}|code-block|syntax|javascript|42726|public+void+Configure(IApplicationBuilder+app,+IWebHostEnvironment+env)
{
++++//+Add+this+above+other+config+options...
++++app.UseCors("AllowAnyOrigin");
}|42727|entityMap^0|13|A|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|R|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|H|7|S|8|@]|D|@]|E|$I|J]]|$1|M|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|N|$]]

For people that are simply creating a Web API in .NET 5 and not a Web App, in <code>Startup.cs</code> you'll need to configure your policy like so:
<pre class="lang-cs prettyprint-override"><code>public void ConfigureServices(IServiceCollection services)
{
 // Additional configs above...
 services.AddCors(options =&gt;
 {
 options.AddPolicy(&quot;AllowAnyOrigin&quot;, builder =&gt;
 {
 // Allow &quot;Access-Control-Allow-Origin: *&quot; header
 builder.AllowAnyOrigin();
 });
 });
}
</code></pre>
<pre class="lang-cs prettyprint-override"><code>public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
 // Add this above other config options...
 app.UseCors(&quot;AllowAnyOrigin&quot;);
}
</code></pre>

blocks|key|42752|text|我知道这听起来很疯狂，但对我来说，它是HttpPost()而不是HttpPost。当我删除多余的圆括号时，它就开始工作了|type|unstyled|depth|inlineStyleRanges|entityRanges|data|42753|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I know this sounds crazy but for me it was [HttpPost()] instead of [HttpPost]. When I removed the redundant parentheses, it started working

I tried everything that is written in this article: <a href="http://www.asp.net/web-api/overview/security/enabling-cross-origin-requests-in-web-api" rel="noreferrer">http://www.asp.net/web-api/overview/security/enabling-cross-origin-requests-in-web-api</a>, but nothing works.
I'm trying to get data from webAPI2 (MVC5) to use in another domain using angularJS.

my controller looks like this:

<pre><code>namespace tapuzWebAPI.Controllers
{
 [EnableCors(origins: "http://local.tapuz.co.il", headers: "*", methods: "*", SupportsCredentials = true)]
 [RoutePrefix("api/homepage")]
 public class HomePageController : ApiController
 {
 [HttpGet]
 [Route("GetMainItems")]
 //[ResponseType(typeof(Product))]
 public List&lt;usp_MobileSelectTopSecondaryItemsByCategoryResult&gt; GetMainItems()
 {


 HomePageDALcs dal = new HomePageDALcs();
 //Three product added to display the data

 //HomePagePromotedItems.Value.Add(new HomePagePromotedItem.Value.FirstOrDefault((p) =&gt; p.ID == id));


 List&lt;usp_MobileSelectTopSecondaryItemsByCategoryResult&gt; items = dal.MobileSelectTopSecondaryItemsByCategory(3, 5);
 return items;

 } 
 }
}
</code></pre>

MVC web api: No 'Access-Control-Allow-Origin' header is present on the requested resource

Visual Studio

包管理器

中间件

服务器

Web App

我尝试了本文中所写的所有方法：，但都不起作用。我正在尝试使用angularJS从webAPI2 (MVC5)获取数据，以便在另一个域中使用。我的控制器看起来像这样：namespace tapuzWebAPI.Controllers{    [EnableCors(origins: "http://local.tapuz...

问MVC web api:请求的资源上不存在“Access-Control-Allow-Origin”标头
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问MVC web api:请求的资源上不存在“Access-Control-Allow-Origin”标头EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问MVC web api:请求的资源上不存在“Access-Control-Allow-Origin”标头
EN