我的 ssl 服务器上有一个后端项目，如 ssl.mybackend.com ，如下所示：
class FormController extends Controller
{
public function behaviors()
{
return [
'access' => [
'class' => AccessControl::className(),
'rules' => [
[
'actions' => ['index', 'delete', 'view', 'create'],
'allow' => true,
'roles' => ['@'], //only authorized users
],
[
'actions'=> ['create-order'],
'allow'=>true //change all users to "myfrontend.com"
]
],
],
];
}
我只需要授予对我的前端网站create-order操作的访问权限。我不确定是否可以使用AccessControl，如果您可以建议其他解决方案，我将不胜感激。
如果要使用来自另一个域前端的 ajax 调用，则应改用 corsFilter。文档中的示例：
public function behaviors()
{
return [
'corsFilter' => [
'class' => 'yii'filters'Cors::className(),
'cors' => [
// restrict access to
'Origin' => ['http://www.myserver.com', 'https://www.myserver.com'],
'Access-Control-Request-Method' => ['POST', 'PUT'],
// Allow only POST and PUT methods
'Access-Control-Request-Headers' => ['X-Wsse'],
// Allow only headers 'X-Wsse'
'Access-Control-Allow-Credentials' => true,
// Allow OPTIONS caching
'Access-Control-Max-Age' => 3600,
// Allow the X-Pagination-Current-Page header to be exposed to the browser.
'Access-Control-Expose-Headers' => ['X-Pagination-Current-Page'],
],
],
];
}
Yii2 中的跨源资源共享