我做了一个小的gwt应用程序并发布了它，但是今天我发现了一个严重的问题。我意识到同源策略问题，因此我将 gwt 应用程序和其余 json 应用程序放在同一服务器上。但显然浏览器不考虑 http://www.xyz.com 和 http://xyz.com 为同一来源，因此当用户登陆 www.xyz.com 时，他无法从 http://xyz.com。
这就是信息：
XMLHttpRequest cannot load http://xyz.com/backend/...
Origin http://www.xyz.com is not allowed by Access-Control-Allow-Origin.
处理这个问题的最佳方法是什么？我用谷歌搜索并首先找到了 .htaccess 解决方案，该解决方案不适用于 tomcat。我最终使用了一个空的登陆页面index.html，仅重定向到没有www的url。这不是最好的解决方案，因为有人仍然可以输入带有 www 的 url，但它不会进入索引页面，因此不会被重定向。
任何帮助将不胜感激。
I've made a small gwt app and released it, but today I found a serious problem. I was aware of the same origin policy issue so I've put my gwt app and rest json app on the same server. But apparently browsers doesn't regard http://www.xyz.com and http://xyz.com as the same source so when a user lands on a www.xyz.com he can't get data from http://xyz.com.
This is the message:
XMLHttpRequest cannot load http://xyz.com/backend/...
Origin http://www.xyz.com is not allowed by Access-Control-Allow-Origin.
What is the best way to deal with this? I've googled and first found .htaccess solution which doesn't work for tomcat. I ended up using a empty landing page index.html with only redirect to url without www in it. It's not the best solution because someone can still type in url with www which is not going to index page so it wont get redirected.
Any help will be appreciated.
发布评论
评论（2）
除非绝对必要，否则不应在应用程序中使用绝对 URL。
即，如果可以从 http://www.example.com。
例如，如果您想从 http://example.com/abc/def 加载一些数据，则输入 < code>“/abc/def” 在您的代码中，不是
“http://example.com/abc/def”。这样，如果满足以下条件，浏览器会将 URL 解析为 http://www.example.com/abc/def应用程序已从 http://www.example.com 加载，或加载到 http://example.com/abc/def 如果它是从 http://example.com。而且您永远不会冒险遵守同源策略。You shouldn't use absolute URLs in your app unless absolutely necessary.
I.e. you should have "http://example.com" in your code if the app can be loaded from http://www.example.com.
For instance, if you want to load some data from, e.g. http://example.com/abc/def, then put
"/abc/def"in your code, not"http://example.com/abc/def". That way, the browser will resolve the URL to either http://www.example.com/abc/def if the app has been loaded from http://www.example.com, or to http://example.com/abc/def if it's been loaded from http://example.com. And you never risk to hit the Same-Origin Policy.您应该只在单个子/域下托管网站。所有到
http://www.example.com的流量都应重定向到http://example.com，反之亦然。You should only host a website under a single sub/domain. All traffic to
http://www.example.comshould be redirected tohttp://example.comor vice versa.