CORS: credentials mode is 'include'

2017-11-10 00:06:15

XMLHttpRequest cannot load http://localhost/Foo.API/token. The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. Origin 'http://localhost:5000' is therefore not allowed access. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

答案

The issue stems from your Angular code:

When withCredentials is set to true, it is trying to send credentials or cookies along with the request. As that means another origin is potentially trying to do authenticated requests, the wildcard ("*") is not permitted as the "Access-Control-Allow-Origin" header.

You would have to explicitely respond with the origin that made the request in the "Access-Control-Allow-Origin" header to make this work.

I would recommend to explicitely whitelist the origins that you want to allow to make authenticated requests, because simply responding with the origin from the request means that any given website can make authenticated calls to your backend if the user happens to have a valid session.

I explain this stuff in this article I wrote a while back.

So you can either set withCredentials to false or implement an origin whitelist and respond to CORS requests with a valid origin whenever credentials are involved


  • 精彩推荐

  • 2019-09-08 21:44:15

    git pre-commit hook failed 解决办法

    今天在上传项目的时候在commit阶段遇到一个问题,无论是在Sourcetree上传还是用命令git commit -m 'xxx'都报了一下错误:

  • 2019-09-08 21:45:31

    git index.lock

    因是在你进行某些比较费时的git操作时自动生成，操作结束后自动删除，相当于一个锁定文件，目的在于防止对一个目录同时进行多个操作。 有时强制关闭进行中的git操作，这个文件没有被自动删除，之后你就无法进行其他操作，必须手动删除，进入.git文件中删除，打开显示隐藏文件。如果没有看见.git文件夹，可以直接用命令rm -f ./.git/index.lock。之后就可以正常使用。 ———————————————— 版权声明：本文为CSDN博主「李瑞豪」的原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接及本声明。 原文链接：https://blog.csdn.net/qq_39520417/article/details/81941111

  • 2019-09-09 05:28:54

    IntelliJ IDEA 进阶教程： 语言注入

    我真的太久没发 IntelliJ 的教程了，最近 Sakura 同学找我帮他配 IntelliJ ，我秀了一下技术，假装自己是老司机。 然后发现 Language Injection 这个非常好用的功能我居然没写教程（很明显，一堆人不知道这个东西）， 于是我又开始写教程了。 本文多图。

  • 2019-09-09 05:32:55

    SrpingBoot 热启动与热部署

    当我们已经启动了一个服务，然后修改代码之后，会自动重新部署。Spring项目通常有新内容修改后需要重新编译然后运行。通过配置Spring boot的热启动配置，可以实现自动编译重启项目，通常要比手动停止，启动项目快。