我正在尝试从我的Angular 2服务向使用Windows身份验证并托管在IIS上的ASP.NET 5 API POST数据。 在对Angular进行了一些修改后,请求被创建为:
var request = new XMLHttpRequest();
request.withCredentials = true;
这解决了我在授权GET请求方面的问题,现在对于第一个GET请求,服务器返回带有以下标头的401响应:
WWW-Authenticate:Negotiate
WWW-Authenticate:NTLM
接着,Angular客户端发送另一个请求,但这次带有包含NTLM令牌的授权头,它可以正常工作。
对于POST请求,我将"Content-Type: application/json"添加到请求头中,因此浏览器会像这样发送第一个请求:
OPTIONS /api/reservation/ HTTP/1.1
Host: localhost:82
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Access-Control-Request-Method: POST
Origin: http://localhost:81
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36
Access-Control-Request-Headers: content-type
Accept: */*
Referer: http://localhost:81/
Accept-Encoding: gzip, deflate, sdch
Accept-Language: pl-PL,pl;q=0.8,en-US;q=0.6,en;q=0.4
服务器响应如下:
HTTP/1.1 401 Unauthorized
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/8.5
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
Date: Wed, 13 Jan 2016 11:54:56 GMT
Content-Length: 6394
但是这次,与GET请求中的授权请求不同,出现了错误:
XMLHttpRequest cannot load http://localhost:82/api/reservation/. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:81' is therefore not allowed access. The response had HTTP status code 401.
对于CORS,我在ASP.NET 5中使用以下配置:
services.AddCors(options => options.AddPolicy("AllowAll", p => p.AllowAnyOrigin().AllowAnyMethod().WithHeaders("accept", "authorization", "content-type", "origin", "x-custom-header").AllowCredentials()));
我能否在IIS中禁用OPTIONS请求的Windows身份验证?或者是否有一种方法可以强制浏览器跟随授权进行后续操作?