我正在使用RESTful API编写某项服务的Web应用程序。该API可在https://api.example
找到,应用程序可在https://app.example
找到。在Chrome和Firefox中,使用CORS的简单GET请求完全正常。一些方法通过POST接受数据并返回带有新uri的303代码在Location头中。
预检OPTIONS请求可以正常工作:
Request Method:OPTIONS
Status Code:200 OK
请求头
Accept:*/*
Accept-Charset:UTF-8,*;q=0.5
Accept-Encoding:gzip,deflate,sdch
Accept-Language:en-US,en;q=0.8,ru;q=0.6
Access-Control-Request-Headers:origin, authorization, content-type
Access-Control-Request-Method:POST
Connection:keep-alive
DNT:1
Host:api.example
Origin:https://app.example
Referer:https://app.example/app/
User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.32 (KHTML, like Gecko) Chrome/27.0.1425.0 Safari/537.32 SUSE/27.0.1425.0
响应头
Access-Control-Allow-Credentials:true
Access-Control-Allow-Headers:Authorization, Content-Type
Access-Control-Allow-Methods:GET,POST,PUT,DELETE,HEAD,OPTIONS
Access-Control-Allow-Origin:https://app.example
Access-Control-Expose-Headers:*
Access-Control-Max-Age:3628800
Connection:keep-alive
Content-Length:0
Date:Sun, 05 May 2013 15:22:50 GMT
Server:nginx/1.2.5
那么实际请求在收到303后就会停止:
Request URL:https://api.example
Request Method:POST
Status Code:HTTP/1.1 303 See Other
响应头:
Server:nginx/1.2.5
Location:https://api.example/some_url
Date:Sun, 05 May 2013 15:27:49 GMT
Content-Type:application/json
Content-Length:0
Connection:keep-alive
Access-Control-Max-Age:3628800
Access-Control-Expose-Headers:*
Access-Control-Allow-Origin:https://app.example
Access-Control-Allow-Methods:GET,POST,PUT,DELETE,HEAD,OPTIONS
Access-Control-Allow-Headers:Authorization, Content-Type
Access-Control-Allow-Credentials:true
RFC规定用户代理应该遵循重定向,但Chrome和FF似乎没有按预期行动。这是浏览器的错误还是我做错了什么?
更新: 如果我使用--disable-web-security启动Chromium一切正常。