我有一个简单的actionmethod，它返回一些json。它在ajax.example.com上运行。我需要从另一个网站someothersite.com访问这个。
如果我尝试调用它，我会得到预期的…:
Origin http://someothersite.com is not allowed by Access-Control-Allow-Origin.
我知道有两种方法可以解决这个问题:JSONP和创建一个自定义HttpHandler 设置标题。
有没有更简单的办法?
对于一个简单的操作来说，是否不可能定义一个允许起源的列表-或者简单地允许所有人?也许是一个动作过滤器?
最理想的是……
return json(mydata, JsonBehaviour.IDontCareWhoAccessesMe);
当前回答
本教程非常有用。简单总结一下:
使用Nuget上提供的CORS包:Install-Package Microsoft.AspNet.WebApi.Cors 在WebApiConfig.cs文件中，将config.EnableCors()添加到Register()方法中。 为你需要处理cors的控制器添加一个属性:
[EnableCors(origins: "<origin address in here>"， headers: "*"， methods: "*")]
其他回答
如果您正在使用IIS 7+，您可以放置一个web。配置文件到根文件夹与此在系统中。网络服务器:
<httpProtocol>
<customHeaders>
<clear />
<add name="Access-Control-Allow-Origin" value="*" />
</customHeaders>
</httpProtocol>
参见:http://msdn.microsoft.com/en-us/library/ms178685.aspx 和http://enable-cors.org/ # how-iis7
After struggling for a whole evening I finally got this to work. After some debugging I found the problem I was walking into was that my client was sending a so called preflight Options request to check if the application was allowed to send a post request with the origin, methods and headers provided. I didn't want to use Owin or an APIController, so I started digging and came up with the following solution with just an ActionFilterAttribute. Especially the "Access-Control-Allow-Headers" part is very important, as the headers mentioned there do have to match the headers your request will send.
using System.Linq;
using System.Web;
using System.Web.Mvc;
namespace MyNamespace
{
public class AllowCrossSiteJsonAttribute : ActionFilterAttribute
{
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
HttpRequest request = HttpContext.Current.Request;
HttpResponse response = HttpContext.Current.Response;
// check for preflight request
if (request.Headers.AllKeys.Contains("Origin") && request.HttpMethod == "OPTIONS")
{
response.AppendHeader("Access-Control-Allow-Origin", "*");
response.AppendHeader("Access-Control-Allow-Credentials", "true");
response.AppendHeader("Access-Control-Allow-Methods", "GET, PUT, POST, DELETE");
response.AppendHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, X-RequestDigest, Cache-Control, Content-Type, Accept, Access-Control-Allow-Origin, Session, odata-version");
response.End();
}
else
{
HttpContext.Current.Response.Cache.SetCacheability(HttpCacheability.NoCache);
HttpContext.Current.Response.Cache.SetNoStore();
response.AppendHeader("Access-Control-Allow-Origin", "*");
response.AppendHeader("Access-Control-Allow-Credentials", "true");
if (request.HttpMethod == "POST")
{
response.AppendHeader("Access-Control-Allow-Methods", "GET, PUT, POST, DELETE");
response.AppendHeader("Access-Control-Allow-Headers", "Origin, X-Requested-With, X-RequestDigest, Cache-Control, Content-Type, Accept, Access-Control-Allow-Origin, Session, odata-version");
}
base.OnActionExecuting(filterContext);
}
}
}
}
最后，我的MVC动作方法看起来像这样。这里重要的是还要提到Options HttpVerbs，否则preflight请求将失败。
[AcceptVerbs(HttpVerbs.Post | HttpVerbs.Options)]
[AllowCrossSiteJson]
public async Task<ActionResult> Create(MyModel model)
{
return Json(await DoSomething(model));
}
本教程非常有用。简单总结一下:
使用Nuget上提供的CORS包:Install-Package Microsoft.AspNet.WebApi.Cors 在WebApiConfig.cs文件中，将config.EnableCors()添加到Register()方法中。 为你需要处理cors的控制器添加一个属性:
[EnableCors(origins: "<origin address in here>"， headers: "*"， methods: "*")]
使主答案工作在MVC 5。
使用System.Web.Mvc而不是System.Web.Http.Filters。
using System;
using System.Web.Mvc;
// using System.Web.Http.Filters;
public class AllowCrossSiteJsonAttribute : ActionFilterAttribute
{
...
}
public ActionResult ActionName(string ReqParam1, string ReqParam2, string ReqParam3, string ReqParam4)
{
this.ControllerContext.HttpContext.Response.Headers.Add("Access-Control-Allow-Origin","*");
/*
--Your code goes here --
*/
return Json(new { ReturnData= "Data to be returned", Success=true }, JsonRequestBehavior.AllowGet);
}
