socket.io、vTiger 和 csrf-magic.js。 CORS 问题

Question

我正在尝试创建 socket.io 模块并将其添加到我的 vTiger 7.0 中，以便我可以为多个用户实时更新字段。

当我们的质量控制试图检查记录时，我们遇到了用户更改应锁定的字段的问题。这是导致不应该获得批准的事情。 Node.js 和 vTiger 将是很棒的附加组件。

唯一的问题是 vTiger 使用 csrf-magic.js 创建一个 token 需要包含在 header 中以允许 CORS

我在我的 node 项目中设置了中间件，以允许我的 vtiger 发出请求

vTiger 在 vtiger.example.com

node 服务器在节点.example.com:3010

//server code node.example.com:3010
const fs = require("fs");
const config = require("./core/config").config();
var options = {
    key: fs.readFileSync(config.key),
    cert: fs.readFileSync(config.cert),
    ca: fs.readFileSync(config.ca),
    requestCert: true,
    rejectUnauthorized: false,
};

const app = require("express")();
const server = require("https").Server(options, app);
const io = require("socket.io")(server);
// Need to send io to socket module

module.exports = io;
app.use(function (req, res, next) {
    var allowedOrigins = [
        "https://node.example.com",
        "https://vtiger.example.com"
    ];
    var origin = req.headers.origin;
        if (allowedOrigins.indexOf(origin) > -1) {
        res.setHeader("Access-Control-Allow-Origin", origin);
    }

    res.header("Access-Control-Allow-Methods", "GET, OPTIONS");
    res.header("Access-Control-Allow-Headers", "Content-Type, Authorization");
    res.header("Access-Control-Allow-Credentials", true);
    
    return next();
});

io.sockets.on("connection", require("./sockets/socket.js"));

const qc = require('./models/qc_model');
app.get('/', (req,res) => {
    res.json({message: 'No Access'});
})

qc.pullLeadInfo(13622196, 10730, (data) => {
    console.log(data.lead.lsloa_ver_by);
});
    




//Start the server
server.listen(config.port, () => {
    console.log("server listening on port: " + config.port);
});

\client side vtiger.example.com
var socket = io.connect('https://node.example.com:3010');

我收到这个错误

Access to XMLHttpRequest at 'https://node.example.com:3010/socket.io/?EIO=4&transport=polling&t=NmEEc_r' from origin 'https://vtiger.example.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
csrf-magic.js:41 GET https://node.example.com:3010/socket.io/?EIO=4&transport=polling&t=NmEEc_r net::ERR_FAILED

我找不到任何处理此问题的好文档。任何帮助都会很棒！

Answer 1

在这里找到信息

https://github.com/socketio/socket.io/issues/3929


// Server

io.engine.on("headers", (headers) => {
  headers["Access-Control-Allow-Private-Network"] = true;
});

// Client

const socket = io({
  extraHeaders: {
    "Access-Control-Request-Private-Network": true
  }
});

socket.io、vTiger 和 csrf-magic.js。 CORS 问题

socket.io, vTiger, and csrf-magic.js. CORS issues

javascript

sockets

node.js

vtiger

vtigercrm