blocks|key|4511204|text|当您打开调试控制台并打开Disable+Cache选项时，将始终发送印前检查请求(即在每个请求之前)。如果不禁用缓存，飞行前请求将只发送一次(每台服务器)|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4511205|entityMap^0|C|D|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

When you have the debug console open and the <code>Disable Cache</code> option turned on, preflight requests will always be sent (i.e. before each and every request). if you don't disable the cache, a pre-flight request will be sent only once (per server)

blocks|key|3641|text|是的，可以避免options请求。Options请求是当您将任何数据发送(post)到另一个域时的印前检查请求。这是一个浏览器安全问题。但是我们可以使用另一种技术:+iframe传输层。我强烈建议你忘记任何CORS配置，使用现成的解决方案，它可以在任何地方工作。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3642|看看这里：https://github.com/jpillora/xdomain|offset|length|3643|工作示例：http://jpillora.com/xdomain/|3644|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/jpillora/xdomain|1|http://jpillora.com/xdomain/^0|0|5|Z|0|0|5|S|1|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@$D|T|E|U|1|V]]|A|$]]|$1|F|3|G|5|6|7|W|8|@]|9|@$D|X|E|Y|1|Z]]|A|$]]|$1|H|3|-4|5|6|7|10|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]|P|$5|K|L|M|A|$N|Q]]]]

Yes it's possible to avoid options request. Options request is a preflight request when you send (post) any data to another domain. It's a browser security issue. But we can use another technology: iframe transport layer. I strongly recommend you forget about any CORS configuration and use readymade solution and it will work anywhere. 

Take a look here:
<a href="https://github.com/jpillora/xdomain" rel="nofollow noreferrer">https://github.com/jpillora/xdomain</a>

And working example:
<a href="http://jpillora.com/xdomain/" rel="nofollow noreferrer">http://jpillora.com/xdomain/</a>

blocks|key|4511175|text|正如在之前的文章中已经提到的，OPTIONS请求的存在是有原因的。如果您遇到服务器响应时间过长的问题(例如海外连接)，您也可以让浏览器缓存印前检查请求。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|4511176|让您的服务器使用Access-Control-Max-Age标头进行回复，对于到达同一端点的请求，印前检查请求将被缓存，并且不再发生。|4511177|entityMap^0|F|7|0|8|M|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|H|3|-4|5|6|7|P|8|@]|D|@]|E|$]]]|I|$]]

As mentioned in previous posts already, <code>OPTIONS</code> requests are there for a reason. If you have an issue with large response times from your server (e.g. overseas connection) you can also have your browser cache the preflight requests.

Have your server reply with the <code>Access-Control-Max-Age</code> header and for requests that go to the same endpoint the preflight request will have been cached and not occur anymore.

blocks|key|4511225|text|我已经像这样解决了这个问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4511226|if($_SERVER['REQUEST_METHOD']+==+'OPTIONS'+&&+ENV+==+'devel')+{
++++header('Access-Control-Allow-Origin:+*');
++++header('Access-Control-Allow-Headers:+X-Requested-With');
++++header("HTTP/1.1+200+OK");
++++die();
}|code-block|syntax|javascript|4511227|它只用于开发。这样，我等待的是9ms和500ms，而不是8s和500ms。我可以这样做，因为生产JS应用程序将与生产在同一台机器上，所以不会有OPTIONS，但开发是我本地的。|offset|length|style|CODE|4511228|entityMap^0|0|0|1Z|7|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Q|8|@$I|R|J|S|K|L]]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

I have solved this problem like.

<pre><code>if($_SERVER['REQUEST_METHOD'] == 'OPTIONS' &amp;&amp; ENV == 'devel') {
 header('Access-Control-Allow-Origin: *');
 header('Access-Control-Allow-Headers: X-Requested-With');
 header("HTTP/1.1 200 OK");
 die();
}
</code></pre>

It is only for development. With this I am waiting 9ms and 500ms and not 8s and 500ms. I can do that because production JS app will be on the same machine as production so there will be no <code>OPTIONS</code> but development is my local.

blocks|key|3597|text|您不能，但是您可以使用JSONP来避免CORS。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3598|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

You can't but you could avoid CORS using JSONP.

blocks|key|3767|text|对我有效的是导入"github.com/gorilla/handlers“，然后这样使用它：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3768|router+:=+mux.NewRouter()
router.HandleFunc("/config",+getConfig).Methods("GET")
router.HandleFunc("/config/emcServer",+createEmcServers).Methods("POST")

headersOk+:=+handlers.AllowedHeaders([]string{"X-Requested-With",+"Content-Type"})
originsOk+:=+handlers.AllowedOrigins([]string{"*"})
methodsOk+:=+handlers.AllowedMethods([]string{"GET",+"HEAD",+"POST",+"PUT",+"OPTIONS"})

log.Fatal(http.ListenAndServe(":"+%2B+webServicePort,+handlers.CORS(originsOk,+headersOk,+methodsOk)(router)))|code-block|syntax|javascript|3769|只要我执行Ajax+POST请求并附加JSON数据，Chrome就会添加Content-Type头文件，而这个头文件并不在我之前的AllowedHeaders配置中。|3770|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

What worked for me was to import "github.com/gorilla/handlers" and then use it this way:

<pre><code>router := mux.NewRouter()
router.HandleFunc("/config", getConfig).Methods("GET")
router.HandleFunc("/config/emcServer", createEmcServers).Methods("POST")

headersOk := handlers.AllowedHeaders([]string{"X-Requested-With", "Content-Type"})
originsOk := handlers.AllowedOrigins([]string{"*"})
methodsOk := handlers.AllowedMethods([]string{"GET", "HEAD", "POST", "PUT", "OPTIONS"})

log.Fatal(http.ListenAndServe(":" + webServicePort, handlers.CORS(originsOk, headersOk, methodsOk)(router)))
</code></pre>

As soon as I executed an Ajax POST request and attaching JSON data to it, Chrome would always add the Content-Type header which was not in my previous AllowedHeaders config.

blocks|key|4511306|text|我过去使用过的一种解决方案是，假设您的站点在mydomain.com上，您需要向foreigndomain.com发出ajax请求|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4511307|配置从您的域到外部域的IIS重写-例如|4511308|<rewrite>
++<rules>
++++<rule+name="ForeignRewrite"+stopProcessing="true">
++++++++<match+url="%5Eapi/v1/(.*)$"+/>
++++++++<action+type="Rewrite"+url="https://foreigndomain.com/{R:1}"+/>
++++</rule>
++</rules>
</rewrite>|code-block|syntax|javascript|4511309|在您的mydomain.com站点上-然后您可以发出同源请求，而不需要任何options请求:)|4511310|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|O|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|P|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

One solution I have used in the past - lets say your site is on mydomain.com, and you need to make an ajax request to foreigndomain.com 

Configure an IIS rewrite from your domain to the foreign domain - e.g. 

<pre><code>&lt;rewrite&gt;
 &lt;rules&gt;
 &lt;rule name="ForeignRewrite" stopProcessing="true"&gt;
 &lt;match url="^api/v1/(.*)$" /&gt;
 &lt;action type="Rewrite" url="https://foreigndomain.com/{R:1}" /&gt;
 &lt;/rule&gt;
 &lt;/rules&gt;
&lt;/rewrite&gt;
</code></pre>

on your mydomain.com site - you can then make a same origin request, and there's no need for any options request :)

blocks|key|4511353|text|如果使用代理来拦截请求并写入适当的标头，则可以解决此问题。在Varnish的特殊情况下，规则如下：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4511354|if+(req.http.host+==+"CUSTOM_URL"+)+{
set+resp.http.Access-Control-Allow-Origin+=+"*";
if+(req.method+==+"OPTIONS")+{
+++set+resp.http.Access-Control-Max-Age+=+"1728000";
+++set+resp.http.Access-Control-Allow-Methods+=+"GET,+POST,+PUT,+DELETE,+PATCH,+OPTIONS";
+++set+resp.http.Access-Control-Allow-Headers+=+"Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since";
+++set+resp.http.Content-Length+=+"0";
+++set+resp.http.Content-Type+=+"text/plain+charset=UTF-8";
+++set+resp.status+=+204;
}|code-block|syntax|javascript|4511355|}|4511356|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

It can be solved in case of use of a proxy that intercept the request and write the appropriate headers. 
In the particular case of Varnish these would be the rules:

<pre><code>if (req.http.host == "CUSTOM_URL" ) {
set resp.http.Access-Control-Allow-Origin = "*";
if (req.method == "OPTIONS") {
 set resp.http.Access-Control-Max-Age = "1728000";
 set resp.http.Access-Control-Allow-Methods = "GET, POST, PUT, DELETE, PATCH, OPTIONS";
 set resp.http.Access-Control-Allow-Headers = "Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since";
 set resp.http.Content-Length = "0";
 set resp.http.Content-Type = "text/plain charset=UTF-8";
 set resp.status = 204;
}
</code></pre>

}

blocks|key|4511401|text|也许有一个解决方案(但我没有测试它)：你可以使用CSP+(内容安全策略)来启用你的远程域，浏览器可能会跳过CORS选项请求验证。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4511402|如果我有时间，我会测试一下并更新这篇文章！|4511403|CSP：https://developer.mozilla.org/fr/docs/Web/HTTP/Headers/Content-Security-Policy|offset|length|4511404|CSP规范：https://www.w3.org/TR/CSP/|4511405|entityMap|0|LINK|mutability|MUTABLE|url|https://developer.mozilla.org/fr/docs/Web/HTTP/Headers/Content-Security-Policy|1|https://www.w3.org/TR/CSP/^0|0|0|4|26|0|0|6|Q|1|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|U|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@$F|W|G|X|1|Y]]|A|$]]|$1|H|3|I|5|6|7|Z|8|@]|9|@$F|10|G|11|1|12]]|A|$]]|$1|J|3|-4|5|6|7|13|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]|R|$5|M|N|O|A|$P|S]]]]

There is maybe a solution (but i didnt test it) : you could use CSP (Content Security Policy) to enable your remote domain and browsers will maybe skip the CORS OPTIONS request verification.

I if find some time, I will test that and update this post !

CSP : <a href="https://developer.mozilla.org/fr/docs/Web/HTTP/Headers/Content-Security-Policy" rel="nofollow noreferrer">https://developer.mozilla.org/fr/docs/Web/HTTP/Headers/Content-Security-Policy</a>

CSP Specification : <a href="https://www.w3.org/TR/CSP/" rel="nofollow noreferrer">https://www.w3.org/TR/CSP/</a>

I am building a web API. I found whenever I use Chrome to POST, GET to my API, there is always an OPTIONS request sent before the real request, which is quite annoying. Currently, I get the server to ignore any OPTIONS requests. Now my question is what's good to send an OPTIONS request to double the server's load? Is there any way to completely stop the browser from sending OPTIONS requests?

Why is an OPTIONS request sent and can I disable it?

服务器

JSON

我正在构建一个web API。我发现每当我使用Chrome来POST，GET到我的API时，总是在真正的请求之前发送一个OPTIONS请求，这是相当恼人的。目前，我让服务器忽略任何OPTIONS请求。现在我的问题是，发送OPTIONS请求使服务器负载加倍有什么好处？有没有办法完全阻止浏览器发送OPTIONS请求？

问为什么发送OPTIONS请求，我可以禁用它吗？
EN

回答 9

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问为什么发送OPTIONS请求，我可以禁用它吗？EN

回答 9

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问为什么发送OPTIONS请求，我可以禁用它吗？
EN