NGINX & # 39; Access-Control-Allow-Origin& # 39;头文件包含多个值 - NGINX 'Access-Control-Allow-Origin' header contains multiple values

NGINX 'Access-Control-Allow-Origin' header contains multiple values

我有一个PHP的NGINX服务器(让我们假设主机名为http://myserver.com)。我有一个PHP脚本，我通过XHR从我的本地主机上的网页访问。我使用它作为一个GeoIP服务器类似于freegeoip.net。

我正在尝试将XHR锁定到特定的域。

这是我的配置设置:

location ~ '.php$ {
    try_files $uri =404;
    fastcgi_pass 127.0.0.1:9000;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
    fastcgi_param GEOIP_COUNTRY_CODE $geoip2_data_country_code;
    fastcgi_param GEOIP_COUNTRY_NAME $geoip2_data_country_name;
    fastcgi_param GEOIP_COUNTRY_GEONAME_ID $geoip2_data_country_geoname_id;
    fastcgi_param GEOIP_CITY_NAME $geoip2_data_city_name;
    fastcgi_param GEOIP_CITY_GEONAME_ID $geoip2_data_city_geoname_id;
    fastcgi_param GEOIP_CONTINENT_CODE $geoip2_data_city_continent_code;
    fastcgi_param GEOIP_CONTINENT_GEONAME_ID $geoip2_data_city_continent_geoname_id;
    fastcgi_param GEOIP_LATITUDE $geoip2_data_city_location_latitude;
    fastcgi_param GEOIP_LONGITUDE $geoip2_data_city_location_longitude;
    fastcgi_param GEOIP_TIME_ZONE $geoip2_data_city_location_timezone;
    fastcgi_param GEOIP_ISP $geoip2_data_city_traits_isp;
    fastcgi_param GEOIP_IP_ADDRESS $geoip2_data_city_traits_ip_address;
    set $cors "";
    if ($http_origin ~* 'https?://(www'.domain1'.com|www'.domain2'.com)')
    {
        set $cors "true";
    }
    if ($cors = 'true')
    {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,Pragma,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With';
    }
    if ($request_method = 'OPTIONS')
    {
        return 204;
    }
}

我遇到的问题是，当我执行XHR请求时，我得到以下错误:

XMLHttpRequest cannot load http://myserver.com/. The 'Access-Control-Allow-Origin' header contains multiple values '*, http://localhost', but only one is allowed. Origin 'http://localhost' is therefore not allowed access.

我在配置文件中只有一个对add_header 'Access-Control-Allow-Origin' "$http_origin";的调用，所以为什么我有多个值?是否有一种方法可以禁用第一个呼叫，即* ?

1。让应用程序动态批准并添加响应头。

$allowed_domains = ['http://allowed.com','http://another_allowed.com'];
function add_cors_header() {
    if (in_array($_SERVER['http_origin'], $allowed_domains)) {
        header('Access-Control-Allow-Origin', $_SERVER['http_origin']);
    }
}

2)。或者安装OpenResty版本的Nginx，启用Lua，并做同样的事情，但在Nginx配置文件中使用Lua。

我所犯的错误是我在PHP文件中有以下内容:

header('Access-Control-Allow-Origin: *');

我之前已经设置好了，只是忘了拿出来。

一切正常