PHP解决跨域请求问题的两种实用方法详解

1

Access to XMLHttpRequest at'http://api.example.com/data'from origin'http://www.example.com'has been blocked by CORS policy: No'Access-Control-Allow-Origin'header is present on the requested resource.

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

<?php

// 设置允许跨域访问

header('Access-Control-Allow-Origin: *');

header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');

header('Access-Control-Allow-Headers: X-Requested-With, Content-Type, Accept, Origin, Authorization');

// 如果是OPTIONS请求，直接返回200

if($_SERVER['REQUEST_METHOD'] =='OPTIONS') {

http_response_code(200);

exit();

}

// 你的API逻辑

echojson_encode(['message'=>'跨域请求成功']);

?>

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

<?php

// 允许指定的域名访问

$allowed_origins= [

'http://localhost:3000',

'https://myapp.com',

'https://staging.myapp.com'

];

$origin=$_SERVER['HTTP_ORIGIN'] ??'';

if(in_array($origin,$allowed_origins)) {

header("Access-Control-Allow-Origin: $origin");

}else{

// 或者允许所有（不推荐生产环境）

// header('Access-Control-Allow-Origin: *');

// 生产环境建议直接拒绝未授权域名

http_response_code(403);

exit('不允许的跨域请求');

}

header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');

header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With');

header('Access-Control-Allow-Credentials: true');

// 处理预检请求

if($_SERVER['REQUEST_METHOD'] =='OPTIONS') {

http_response_code(200);

exit();

}

// API业务逻辑

?>