我知道这个问题已经被问了十几次,每一个答案都表明我做得很正确,但也许我还是漏掉了什么。
AJAX会这样处理CORS请求...
$.ajax({
url: 'someotherdomain.com',
type: 'post',
data: {key: 'value'},
dataType: 'json',
async: false,
crossDomain: true,
beforeSend: function(xhr){
xhr.withCredentials = true;
},
success: function(x, status, xhr){
},
error: function(xhr, status, error){
}
});
PHP像这样处理CORS请求...
header('Access-Control-Max-Age: 1728000');
header('Access-Control-Allow-Origin: http://someotherdomain.com');
header('Access-Control-Allow-Methods: POST');
header('Access-Control-Allow-Headers: Content-MD5, X-Alt-Referer');
header('Access-Control-Allow-Credentials: true');
header("Content-Type: application/json; charset=utf-8");
根据所有文档,只要设置了服务器端的“Access-Control-Allow-Credentials”头和客户端的“withCredentials=true”头,跨域之间的会话cookie处理应该是透明的。我有遗漏什么吗?