Preflight request ok，然后，auth之后，response不包含allow cors header

Question

Asp 在 IIS 8.5 上部署的 MVC 5 应用程序。需要启用来自多个客户端的 ajax 请求。

Server-side 我在 WebApiConfig.cs

config.EnableCors();

在控制器中：

[EnableCors(origins: "http://localhost:59901", headers: "*", methods: "*", SupportsCredentials = true)]
public class ItemController : Controller

客户端

$("#getItem").on("click", function (e) {
    var myurl = "http://servername/item/details/1"

    $.ajax({
        url: myurl,
        type: "GET",
        dataType: "JSON",
        xhrFields: {
            withCredentials: true
        },
        contentType: "application/json; charset=utf-8",
        error: function (jqXHR, textStatus, errorThrown) {
            $('#result').text(jqXHR.responseText || textStatus);
        },
        success: function (result) {
            $('#result').text(result);
        }
    });
});

运行来自 VisualStudio Origin 的客户端是 http://localhost:59901。

运行 ajax 请求我在 fiddler 中得到以下内容：

1.预检 request/response

OPTIONS http://vrtsrv01.webdev.local/item/details/1 HTTP/1.1
Host: vrtsrv01.webdev.local
Connection: keep-alive
Access-Control-Request-Method: GET
Origin: http://localhost:59901
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Access-Control-Request-Headers: content-type
Accept: */*
Referer: http://localhost:59901/Home/Index
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,it;q=0.6,it-IT;q=0.4

HTTP/1.1 200 OK
Server: Microsoft-IIS/8.5
Access-Control-Allow-Origin: http://localhost:59901
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, MaxDataServiceVersion
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Credentials: true
X-Powered-By: ASP.NET
Date: Sat, 13 May 2017 15:34:54 GMT
Content-Length: 0

2。没有凭据的 GET 请求/401 错误响应

GET http://vrtsrv01.webdev.local/item/details/1 HTTP/1.1
Host: vrtsrv01.webdev.local
Connection: keep-alive
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://localhost:59901
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Content-Type: application/json; charset=utf-8
Referer: http://localhost:59901/Home/Index
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,it;q=0.6,it-IT;q=0.4

HTTP/1.1 401 Unauthorized
Cache-Control: private
Content-Type: text/html
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
Date: Sat, 13 May 2017 15:34:54 GMT
Content-Length: 1352
Proxy-Support: Session-Based-Authentication

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>401 - Autorizzazione negata: accesso negato a causa di credenziali non valide.</title>
....
</head>
<body>
<div id="header"><h1>Errore del server</h1></div>
....
</body>
</html>

3。获取带有 NTLM 令牌的请求以进行身份验证/响应而无需允许 CORS header

GET http://vrtsrv01.webdev.local/item/details/1 HTTP/1.1
Host: vrtsrv01.webdev.local
Connection: keep-alive
Authorization: Negotiate <...NTLM TOKEN HERE ...>
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://localhost:59901
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36
Content-Type: application/json; charset=utf-8
Referer: http://localhost:59901/Home/Index
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8,it;q=0.6,it-IT;q=0.4


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json; charset=utf-8
Server: Microsoft-IIS/8.5
X-AspNetMvc-Version: 5.2
X-AspNet-Version: 4.0.30319
Persistent-Auth: true
X-Powered-By: ASP.NET
Date: Sat, 13 May 2017 15:34:58 GMT
Content-Length: 8557

{"id":1, .....}

问题

为什么在为 CORS 启用 MVC 应用程序并看到对预检请求的正确响应后，NTLM 身份验证后获得的响应不包含预期的 Access-Control-Allow-Origin header？

Answer 1

我不确定它是否会对您有所帮助，但它可能会对希望同时启用 NTLM 和 CORS 的其他人有所帮助。

启用 CORS

public static class WebApiConfig
{
    public static void Register(HttpConfiguration config)
    {
        var corsAttr = new EnableCorsAttribute("*", "*", "*") { SupportsCredentials = true };
        //SupportsCredentials = true means that we will add Access-Control-Allow-Credentials to the response.
        config.EnableCors(corsAttr);
    }
}

SupportsCredentials = true 表示我们将在响应中添加 Access-Control-Allow-Credentials。

其他解决方案，

global.asax.cs - 正确回复 headers 允许来自另一个域的调用者接收数据

protected void Application_AuthenticateRequest(object sender, EventArgs e)
{
    if (Context.Request.HttpMethod == "OPTIONS")
    {
        Context.Response.AddHeader("Access-Control-Allow-Origin", Context.Request.Headers["Origin"]);
        Context.Response.AddHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept,MaxDataServiceVersion");
        Context.Response.AddHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
        Context.Response.AddHeader("Access-Control-Allow-Credentials", "true");
        Context.Response.End();
    }
}

Answer 2

已解决（...暂时...）调用的操作是一个返回 Json 的控制器操作。这不适用于 CORS。我需要创建一个 API 控制器，不能使用现有的控制器。这会导致代码重复，但我现在没有时间重构整个应用程序以对 MVC 和 API

使用单个控制器

Preflight request ok，然后，auth之后，response不包含allow cors header

Preflight request is ok, then, after auth, response does not contain allow cors header

ajax

asp.net-mvc

ntlm

cors

asp.net-web-api2