跨域资源共享 (CORS) 是否区分 HTTP 和 HTTPS?

Does Cross-Origin Resource Sharing(CORS) differentiate between HTTP AND HTTPS?(跨域资源共享 (CORS) 是否区分 HTTP 和 HTTPS?)
本文介绍了跨域资源共享 (CORS) 是否区分 HTTP 和 HTTPS?的处理方法,对大家解决问题具有一定的参考价值,需要的朋友们下面随着小编来一起学习吧!

问题描述

我有两个网站:https//:www.domain-only-uses-https.com 和 www.domain-uses-both-http-and-https.com

I have two sites : https//:www.domain-only-uses-https.com and www.domain-uses-both-http-and-https.com

现在我在前者的页面中向后者发出2个ajax GET请求,一个是

Now I am making 2 ajax GET requests in the page of the former to the later, one is

https://www.domain-uses-both-http-and-https.com/some-path  (using the HTTPS scheme) 

另一个是

http://www.domain-uses-both-http-and-https.com/some-other-path (using the HTTP scheme)

我确实将https//:www.domain-only-uses-https.com"设置为服务器www.domain-uses-"中Access-Control-Allow-Origin:"标头的值http-和-https.com".

And I DID set the "https//:www.domain-only-uses-https.com" as the value of "Access-Control-Allow-Origin:" header in the server "www.domain-uses-both-http-and-https.com ".

但现在看来 Chrome 只允许请求 1,而请求 2 被禁止.

But now it seems that only request 1 is allowed by Chrome ,but request 2 is forbidden.

所以我的问题是:Access-Control-Allow-Origin"标头是否区分 HTTP 和 HTTPS?希望我已经说清楚了..

So my question is : does the "Access-Control-Allow-Origin" header differentiate between HTTP AND HTTPS? Hope I've made myself clear..

推荐答案

是的,HTTP 和 HTTPS 的来源不同.

Yes, HTTP and HTTPS origins are different.

originhostnameportscheme 的组合.

An origin is a combination of hostname, port, and scheme.

  http://foo.example.com:8080/
  ^^^^   ^^^^^^^^^^^^^^^ ^^^^
   ||           ||        ||
 scheme      hostname    port

如果不是所有这些字段在两个资源之间都匹配,则这些资源来自不同的来源.因此,您必须明确指定资源是可以从使用 HTTP 方案的源访问还是使用 HTTPS 方案的源访问.

If not all of these fields match between two resources, then the resources are from different origins. Thus, you must expressly specify whether the resource is accessible from the origin with an HTTP scheme or the origin with an HTTPS scheme.

某些浏览器只允许 Access-Control-Allow-Origin 标头包含与每个响应一起发送的准确的一个来源(或 *);但是,您的服务器可以检测到请求的 Origin 标头并在 CORS 响应中发送相同的来源.

Some browsers only allow the Access-Control-Allow-Origin header to contain exactly one origin (or *) sent with each response; however, your server can detect the request's Origin header and send the same origin in the CORS response.

这篇关于跨域资源共享 (CORS) 是否区分 HTTP 和 HTTPS?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持编程学习网!

本站部分内容来源互联网,如果有图片或者内容侵犯您的权益请联系我们删除!

相关文档推荐

Update another component when Formik form changes(当Formik表单更改时更新另一个组件)
Formik validation isSubmitting / isValidating not getting set to true(Formik验证正在提交/isValiating未设置为True)
React Validation Max Range Using Formik(使用Formik的Reaction验证最大范围)
Validation using Yup to check string or number length(使用YUP检查字符串或数字长度的验证)
Updating initialValues prop on Formik Form does not update input value(更新Formik表单上的初始值属性不会更新输入值)
password validation with yup and formik(使用YUP和Formick进行密码验证)