Clojure 跨源错误 - 完全丢失

Question

我在 Clojure 中有以下使用 Compojure 的简单服务器（这是环形模式的某种风格）。在开发中一切正常，现在我在生产中，我无法让 CORS 在我的生活中工作 - 我有一个 wrap-preflight 功能似乎工作正常，但我不断收到 CORS 错误在终端中，post 或获取我的评论系统请求都不起作用。我完全迷失了，非常沮丧，我四处打听，似乎没有其他人知道。

这是主要的core.clj代码——如果有人有任何想法请告诉我。您可以在 thedailyblech.com 看到实时错误（不是广告，但可能有助于调试）。

谢谢！

(ns clojure-play.core
  (:use     org.httpkit.server
            [compojure.core :refer :all]
            [compojure.route :as route]
            [clojure.data.json :as json]
            [clojure.tools.logging :only [info]]
            [clojure-play.routes :as routes]
            [ring.middleware.json :only [wrap-json-body]]
            [ring.middleware.cors :refer [wrap-cors]])
  (:require [monger.core :as mg]
            [monger.collection :as mc]
            [clojure.edn :as edn]
            [clojure.java.io :as io]
            [compojure.handler :as handler])
  (:import [org.bson.types ObjectId]
           [com.mongodb DB WriteConcern])
  (:gen-class))
(println "in the beginning was the command line...")

(defonce channels (atom #{}))

(defn connect! [channel]
  (info "channel open")
  (swap! channels conj channel))

(defn notify-clients [msg]
  (doseq [channel @channels]
    (send! channel msg)))

(defn disconnect! [channel status]
  (info "channel closed:" status)
  (swap! channels #(remove #{channel} %)))


(defn ws-handler [request]
  (with-channel request channel
    (connect! channel)
    (on-close channel (partial disconnect! channel))
    (on-receive channel #(notify-clients %))))

(defn my-routes [db]
  (routes
   (GET "/foo" [] "Hello Foo")
   (GET "/bar" [] "Hello Bar")
   (GET "/json_example/:name" [] routes/json_example)
   (GET "/json_example" [] routes/json_example)
   (POST "/email" [] routes/post_email)
   (POST "/write_comment" [] (fn [req] (routes/write_comment req db)))
   (POST "/update_comment" [] (fn [req] (routes/update_comment req db)))
   (GET "/read_comments/:path" [path] (fn [req] (routes/read_comments req db path)))
   (GET "/read_comments/:path1/:path2" [path1 path2] (fn [req] (routes/read_comments req db (str path1 "/" path2))))
   (GET "/ws" [] ws-handler)))

(defn connectDB []
  (defonce connection
    (let
     [uri "mongodb://somemlabthingy"
      {:keys [conn db]} (mg/connect-via-uri uri)]
      {:conn conn
       :db db}))
  {:db (:db connection)
   :conn (:conn connection)})

(def cors-headers
  "Generic CORS headers"
  {"Access-Control-Allow-Origin"  "*"
   "Access-Control-Allow-Headers" "*"
   "Access-Control-Allow-Methods" "GET POST OPTIONS DELETE PUT"})

(defn preflight?
  "Returns true if the request is a preflight request"
  [request]
  (= (request :request-method) :options))

(defn -main
  "this is main"
  [& args]

  (println "hello there main")

  (def db (get (connectDB) :db))

  (println (read-string (slurp (io/resource "environment/config.edn"))))


  (defn wrap-preflight [handler]
    (fn [request]
      (do
        (println "inside wrap-preflight")
        (println "value of request")
        (println request)
        (println "value of handler")
        (println handler)
        (if (preflight? request)
          {:status 200
           :headers cors-headers
           :body "preflight complete"}
          (handler request)))))

  (run-server
   (wrap-preflight
    (wrap-cors
     (wrap-json-body
      (my-routes db)
      {:keywords? true :bigdecimals? true})
     :access-control-allow-origin [#"http://www.thedailyblech.com"]
     :access-control-allow-methods [:get :put :post :delete :options]
     :access-control-allow-headers ["Origin" "X-Requested-With"
                                    "Content-Type" "Accept"]))
   {:port 4000}))

Answer 1

可能值得尝试并添加明确的

(OPTIONS "/*" req handle-preflight)

路由到您的 Compojure 路由 - 在我的例子中，这就是它起作用的原因。

Answer 2

CORS 中间件会自动处理预检内容——您不需要单独的中间件，也不需要生成自己的 headers 等

你用它包装了正确的 routes -- 所以 CORS-checking 首先发生，然后路由。您应该删除您的自定义预检中间件，它应该在那时工作。

我们在工作中使用 wrap-cors，我们遇到的唯一困难是允许足够的 headers（一些由生产基础设施插入，如负载平衡器）。我们最终得到了这个：

                           :access-control-allow-headers #{"accept"
                                                           "accept-encoding"
                                                           "accept-language"
                                                           "authorization"
                                                           "content-type"
                                                           "origin"}

对于它的价值，这是我们的方法：

                           :access-control-allow-methods [:delete :get
                                                          :patch :post :put]

（你不需要:options）

Answer 3

(RING-MIDDLEWARE-CORS/wrap-cors

:access-control-allow-credentials "true"

:access-control-allow-origin [#".*"]

:access-control-allow-headers #{"接受" “接受编码” “接受语言” “授权” “内容类型” “起源”}

:access-control-allow-methods [:get :put :post :delete :options])

Answer 4

经过数小时的挖掘，我发现 this to be super helpful on an issues post on the ring-cors github，其文档严重缺乏。

使用链接的要点，我能够解决 CORS 问题：

; Copied from linked gist
(def cors-headers
  "Generic CORS headers"
  {"Access-Control-Allow-Origin"  "*"
   "Access-Control-Allow-Headers" "*"
   "Access-Control-Allow-Methods" "GET"})

(defn preflight?
  "Returns true if the request is a preflight request"
  [request]
  (= (request :request-method) :options))

(defn all-cors
  "Allow requests from all origins - also check preflight"
  [handler]
  (fn [request]
    (if (preflight? request)
      {:status 200
       :headers cors-headers
       :body "preflight complete"}
      (let [response (handler request)]
        (update-in response [:headers]
                   merge cors-headers )))))

; my -main
(defn -main
  "Main entry point"
  [& args]
  (let [port (Integer/parseInt (or (System/getenv "PORT") "8081"))]

  (server/run-server
    (all-cors
      (wrap-defaults #'app-routes site-defaults))
        {:port port})
    (println "Running on" port)))

这终于让我看到 headers 在 Chrome 开发工具中正确设置，也摆脱了我的 React front-end.

上的警告

Access-Control-Allow-Headers: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *

Clojure 跨源错误 - 完全丢失

Clojure Cross Origin Error - Totally Lost

http

clojure

request

cors

preflight