Cross Origin 4xx 错误响应被阻止
我正在使用 XMLHttpRequest level2 进行跨源请求。 问题是，如果服务器返回错误代码，例如 409，浏览器将不允许我访问服务器返回的响应文本。 因此，如果服务器返回 409 并显示消息：“you are not allowed to do that again” 我只在客户端收到 409，但 xhr.responseText 为空...
这是规范的一部分还是我缺少标头或其他内容？
I'm doing a cross origin request using XMLHttpRequest level2.
The problem is if the server returns an error code, like 409 the browser doesn't allow me to access the response text that the server is returning.
So if the server returns 409 with the message: "you are not allowed to do that again"
i only get the 409 on the client side but the xhr.responseText is empty...
is this a part of the specification or i'm missing a header or something?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
补充一下 monsur 所说的，规范对于这个特定用例并不完全清楚，但是如果你看一下第 7.3 节。在处理跨源请求状态时，它指示实现者针对各种错误“确保不泄露有关请求的任何进一步信息”。尽管这看起来过于保守，但您也可以认为这是一种良好/安全的最佳实践。请参阅：http://www.w3.org/TR/cors/ #cors-api-规范-响应
To add to what monsur said, the spec is not entirely clear on this particular use case, but if you take a look at section 7.3. Dealing with the Cross-Origin Request Status, it instructs implementors to "ensure not the reveal any further information about the request" for various errors. Although this may seem over-conservative, you could also argue that this is a good/secure best practice. See: http://www.w3.org/TR/cors/#cors-api-specification-response
我认为这是浏览器对 CORS 实施过于保守的结果。我什至注意到在 Safari 中，抛出错误时 statusCode 为 0，而不是实际的 HTTP 状态。我认为在浏览器完善 onError 情况之前你无能为力。如果您可以控制服务器，则始终可以返回 HTTP 状态 200，然后将错误代码放入正文中。如果您想使用更标准的东西，JSON-RPC (http://json-rpc.org/) 可以做到这一点。
I believe this is a result of over-conservative browser implementation of CORS. I've even noticed in Safari that the statusCode is 0 when an error is thrown, rather than the actual HTTP status. I don't think there's anything you can do until browsers polish up the onError case. If you have control of the server, you could always return HTTP status 200, and then put the error code in the body. JSON-RPC (http://json-rpc.org/) does this, if you want to use something more standard.