CORS问题随着前飞行的响应

Question

我正在做一个Axios的电话，以获取博客文章，但是我面临CORS问题。我尝试了一切，但我不明白这个问题。这是我的代码：

 axios({
    method: "POST",
    url: process.env.REACT_APP_API_URL + '/pages/articles',
    headers: { 'Content-Type': 'application/json;charset=UTF-8', "Access-Control-Allow-Origin": "*", "Accept": "application/json" },
    data: {
    country: localStorage.getItem("locale")
 }
 }).then(result => {
    setPosts(result.data.json.articles);
 });

在我的 /config/bootstrap.php中，

header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization');
header("Access-Control-Allow-Credentials: true");
header('Content-Type: application/json');
$method = $_SERVER['REQUEST_METHOD'];
if ($method == "OPTIONS") {
    header('Access-Control-Allow-Origin: *');
    header("Access-Control-Allow-Headers: X-API-KEY, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method,Access-Control-Request-Headers, Authorization");
    header("HTTP/1.1 200 OK");
    die();
}

控制台中的问题是：

Access to XMLHttpRequest at 'https://api.mysite.fr/pages/articles' from 
origin 'https://mysite.fr' has been blocked by CORS policy: Response to 
preflight request doesn't pass access control check: It does not have 
HTTP ok status.

Answer 1

在示例中，请在服务器上应用CORS验证，而不是前端：
JavaScript中的请求
这向您展示了如何在JavaScript中提出本政策允许的请求。

var http_request;
http_request = new XMLHTTPRequest();
http_request.onreadystatechange = function () { /* .. */ };
http_request.open("POST", "process.env.REACT_APP_API_URL + '/pages/articles'");
http_request.withCredentials = true;
http_request.setRequestHeader("Content-Type", "application/json");
http_request.send({ 'request': "authentication token" });

我们正在发送包含JSON的帖子请求，我们将包括我们的cookie。它与这些标头产生了请求：

Origin: https://mysite.fr
Access-Control-Request-Method: POST
Access-Control-Request-Headers: Content-Type

用于PHP项目

// Allow from any origin
    if (isset($_SERVER['HTTP_ORIGIN'])) {
        // Decide if the origin in $_SERVER['HTTP_ORIGIN'] is one
        // you want to allow, and if so:
        header("Access-Control-Allow-Origin: {$_SERVER['HTTP_ORIGIN']}");
        header('Access-Control-Allow-Credentials: true');
        header('Access-Control-Max-Age: 86400');    // cache for 1 day
    }

    // Access-Control headers are received during OPTIONS requests
    if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {

        if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']))
            // may also be using PUT, PATCH, HEAD etc
            header("Access-Control-Allow-Methods: GET, POST, OPTIONS");         

        if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']))
            header("Access-Control-Allow-Headers: {$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']}");

        exit(0);
    }