laravel - 预检响应中的 Access-Control-Allow-Headers 不允许请求头字段 X-CSRF-TOKEN

Question

我有一个 Laravel 项目，当我运行时 php 工匠服务 ，浏览器显示错误:

Failed to load http://127.0.0.1:8000/api/news/get-news-list: Request header field X-CSRF-TOKEN is not allowed by Access-Control-Allow-Headers in preflight response.

我的代码如下:

axios.get(domainName+'/api/news/get-news-list').then(response=>{
    news = response.data.list;
}).catch(function (error) {
    console.log(error);
});

我已经添加了如下中间件:

内核.php

protected $middleware = [
    \App\Http\Middleware\Cors::class
];

protected $routeMiddleware = [
    'cors' => \App\Http\Middleware\Cors::class
];

Cors.php

public function handle($request, Closure $next)
{
    return $next($request)
        ->header('Access-Control-Allow-Origin','*')
        ->header('Access-Control-Allow-Methods','GET,POST,PUT,PATCH,DELETE,OPTIONS')
        ->header('Access-Control-Allow-Headers','Content-Type,Authorization');

}

api.php

Route::prefix('news')->group(function () {
    Route::get('get-news-list', 'API\NewsController@getList')->middleware('cors');
});

谁能告诉我如何解决这个问题？

Answer 1

只需添加 x-csrf-token标题到允许列表。在你的情况下，它在 Cors.php文件，标题 Access-Control-Allow-Headers .
Access-Control-Allow-Headers控制 CORS 请求中允许使用哪些 header 。