如何解决同源策略来为 Google AppEngine 网站开发 AJAX 客户端代码？
我正在与一个拥有 Google AppEngine 网站的人合作，该网站上有一个自定义 API。
我需要编写一些 AJAX Javascript 来与网站上的自定义 API 交互，但我受到同源策略的阻碍。 JSONP 将毫无用处，因为您无法从失败的“AJAX”请求中获取错误回调（它不使用 XMLHTTPRequest）。我正在使用 JQuery 来发出请求。
显然，Google AppEngine 有一个可怕的警告，即您无法单独上传单个文件进行测试，因此我无法通过直接在 API 的正确域上进行开发来解决此问题。
我使用的是 MAC，听说你可以设置某种代理来解决这个问题，我什至不知道从哪里开始，如果不是绝对必要，我也不想这样做。我该怎么做才能让我针对这个 API 开发一些 AJAX JS？
I'm working with someone who has a Google AppEngine site with a custom API located there.
I need to write some AJAX Javascript to interface with the custom API on the site, but I'm getting stonewalled by the same-origin policy. JSONP will be of no use because you can't get an error callback from a failed 'AJAX' request (it doesn't use XMLHTTPRequest). I am using JQuery to make the requests.
Apparently Google AppEngine has a terrible caveat that you can't individually upload single files for testing, so I can't fix this problem by developing directly on the API's proper domain.
I'm on a MAC and I have heard you can set up some kind of proxy to get around this, I have no idea even where to start with that, and don't want to if I don't absolutely have to. What can I do to allow me to develop some AJAX JS against this API?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
如果您只是寻找开发时解决方案（即设置代理），我会推荐 Charles Web Proxy (http://www.charlesproxy.com/)。
这是我用于本地开发的东西 - 它可以拦截对 URL 的请求并将其重定向到其他位置以解决跨域问题（用于本地开发和测试 - 当然不是生产）。设置和工作非常容易，并且可以免费试用。
If you're just looking for a development-time solution (i.e. setting up a proxy) I would recommend Charles Web Proxy (http://www.charlesproxy.com/).
It's what I use for my local development - it can intercept requests to URLs and redirect them to other locations to get around cross-domain issues (for local development and testing - not production of course). It's pretty easy to get setup and working, and there is a free trial available.
一般来说，JSONP API 不会因为这个原因而无法响应。即使出现问题，设计良好的系统也会做出类似以下的响应：
或类似的内容。因此，您应该始终得到响应，除非存在网络连接问题或服务器出现严重故障（例如 App Engine 出现故障）。如果 API 没有返回有效的 JSON 错误，我建议更改它。
Generally, JSONP APIs do not fail to respond, for that reason among others. Even if something goes wrong, well-designed ones respond with something like:
or similar. Thus, you should always get a response unless there's a network connectivity issue or the server has a serious failure (e.g. App Engine goes down). If the API does not return valid JSON for errors, I would suggest changing that.
您的问题的解决方案是 CORS。你朋友的网站必须允许 CORS，如果你希望你的代码支持 IE（听起来好像你不支持），你必须使用特殊的插件，例如 这个。
The solution to your problem is CORS. Your friend's site has to permit CORS and if you want your code to support IE (it sounds like you don't) you have to use a special plugin like this one.
我通过削弱浏览器（Chrome）中的同源策略支持来解决这个问题，使其不再起作用或受到尊重。在开发过程中，我可以发出跨域请求，浏览器不会采取行动阻止它们。如果你像我一样遇到这个问题，请像这样启动 Chrome：
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --disable-web-security
这显然是一个仅供开发的解决方案，但仅此而已我需要。对于更广泛的解决方案，上述关于 CORS 和 JSONP + 正确设计的 JSONP API 的答案更合适。
I solved this problem by nerfing the same-origin policy support in my browser (Chrome) such that it no longer functions or is honored. During development, I can make cross-domain requests and the browser will not act to prevent them. If you run into this problem like I did, launch Chrome like this:
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --disable-web-security
This is obviously a development-only solution, but thats all I needed. For more extensive solutions the above answers concerning CORS and JSONP + properly designed JSONP APIs are more appropriate.