我注意到 XMLHttpRequest.getResponseHeader() 的结果并不总是与返回的真实标头匹配（如果以常规方式发出请求）。
例如，假设我正在向 https://foo.example.com/api/resource/100 发出 xhr 请求。在 Chrome 的开发者控制台的“网络”下，我可以看到正在做出的响应 - 我还可以看到所有响应标头（例如 10）。但是（复制粘贴控制台）：
> response
XMLHttpRequest
> response.getAllResponseHeaders();
"content-type: text/html
"
可用的标头是否有任何限制？这取决于响应类型吗？我记得有一套完整的 404 标头，但只有这个 400 标头。
什么给？
I've noticed that the results of and XMLHttpRequest.getResponseHeader() don't always match the real headers returned (if the request is made in a regular manner).
For example, assume I'm making an xhr request for https://foo.example.com/api/resource/100. In Chrome's developer console, under 'Network', I can see the response being made -- I can also see all of the response headers (say, 10). However (copy-pasted console):
> response
XMLHttpRequest
> response.getAllResponseHeaders();
"content-type: text/html
"
Are there any restrictions on what headers are available? Is this dependent on the response type? I remember getting a complete set of headers for 404s but just this one for 400s.
What gives?
发布评论
评论（2）
XMLHttpRequest API 标准化的当前状态仅限制对 Set- 的访问Cookie 和 Set-Cookie2 标头字段：
应返回任何其他标头字段。
但当您进行跨源请求时，浏览器需要实现 XMLHttpRequest Level 2因为原始 XMLHttpRequest 只允许同源请求：
在那里您可以读到“跨源资源共享规范过滤标头 过滤getResponseHeader() 对于非 同源 请求。”。并且该规范禁止访问除简单响应头字段<之外的任何响应头字段< /a> （即缓存控制、内容语言、内容类型、过期、最后修改，和Pragma）：
The current state of standardizing the XMLHttpRequest API does only restrict the access to the Set-Cookie and Set-Cookie2 header fields:
Any other header field should be returned.
But as you’re doing a cross-origin request, the browser needs to implement XMLHttpRequest Level 2 as the original XMLHttpRequest does only allow same-origin requests:
There you can read that the “Cross-Origin Resource Sharing specification filters the headers that filters the headers that are exposed by getResponseHeader() for non same-origin requests.”. And that specification forbids access to any response header field other except the simple response header fields (i.e. Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, and Pragma):
它是
Access-Control-Allow-Origin标头以及它允许防止哪些标头暴露给浏览器的方式。 mozilla 文档。It's the
Access-Control-Allow-Originheader and the way it allows to prevent which headers are exposed to the browser. Docs at mozilla.