django-cors-headers not work

问题:

django-cors-headers not work

INSTALLED_APPS = (     'django.contrib.admin',     'django.contrib.auth',     'django.contrib.contenttypes',     'django.contrib.sessions',     'django.contrib.messages',     'django.contrib.staticfiles',     'django.contrib.gis',     'corsheaders',     'rest_framework',     'world',     'userManager',     'markPost',     'BasicServices', )   MIDDLEWARE_CLASSES = (     'django.contrib.sessions.middleware.SessionMiddleware',     'corsheaders.middleware.CorsMiddleware',     'django.middleware.common.CommonMiddleware',     'django.middleware.csrf.CsrfViewMiddleware',     'django.contrib.auth.middleware.AuthenticationMiddleware',     'django.contrib.auth.middleware.SessionAuthenticationMiddleware',     'django.contrib.messages.middleware.MessageMiddleware',     'django.middleware.clickjacking.XFrameOptionsMiddleware', )  CORS_ORIGIN_ALLOW_ALL = True CORS_ALLOW_CREDENTIALS = True 

Everything is normal, but did not work

here my response headers

Cache-Control: max-age=0 Content-Type: text/html; charset=utf-8 Date: Tue, 20 Jan 2015 13:16:17 GMT Expires: Tue, 20 Jan 2015 13:16:17 GMT Last-Modified: Tue, 20 Jan 2015 13:16:17 GMT Server: WSGIServer/0.1 Python/2.7.8 Set-Cookie: csrftoken=snXksqpljbCLW0eZ0EElFxKbiUkYIvK0; expires=Tue, 19-Jan-2016 13:16:17 GMT; Max-Age=31449600; Path=/ Vary: Cookie X-Frame-Options: SAMEORIGIN 

回答1:

According to the process_response code from CorsMiddleware:

response[ACCESS_CONTROL_ALLOW_ORIGIN] = "*" if (             settings.CORS_ORIGIN_ALLOW_ALL and             not settings.CORS_ALLOW_CREDENTIALS) else origin 

You must set settings like this:

# CORS Config CORS_ORIGIN_ALLOW_ALL = True CORS_ALLOW_CREDENTIALS = False 

回答2:

I guess corsheaders and clickjacking middlewares are not compatible. At least I got rid off X-Frame-Options header when I commented out django.middleware.clickjacking.XFrameOptionsMiddleware.

I've just CORS_ORIGIN_ALLOW_ALL = True setting.

回答3:

If you are testing this you need to ensure you include at least the Origin header in the request.

E.g.:

$ http GET http://127.0.0.1:8000/todos/ Origin:http://www.someorigin.com HTTP/1.0 200 OK Access-Control-Allow-Origin: * Allow: GET, POST, HEAD, OPTIONS Content-Type: application/json Date: Sat, 14 Nov 2015 04:42:38 GMT Server: WSGIServer/0.1 Python/2.7.10 Vary: Accept, Cookie X-Frame-Options: SAMEORIGIN 

You will get more feedback with a preflight CORS request:

$ http OPTIONS http://127.0.0.1:8000/todos/ Origin:http://www.someorigin.com HTTP/1.0 200 OK Access-Control-Allow-Headers: x-requested-with, content-type, accept, origin, authorization, x-csrftoken, user-agent, accept-encoding Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400 Allow: GET, POST, HEAD, OPTIONS Content-Type: application/json Date: Sat, 14 Nov 2015 04:45:37 GMT Server: WSGIServer/0.1 Python/2.7.10 Vary: Accept, Cookie X-Frame-Options: SAMEORIGIN 

回答4:

Do not forget to add

'corsheaders.middleware.CorsMiddleware',

at top of MIDDLEWARS variable :

See docs :

CorsMiddleware should be placed as high as possible, especially before any middleware that can generate responses such as Django's CommonMiddleware or Whitenoise's WhiteNoiseMiddleware. If it is not before, it will not be able to add the CORS headers to these responses.

回答5:

From Django 2 MIDDLEWARE_CLASSES is changed to MIDDLEWARE. In this case if you have Django 2 make sure the MIDDLWARE is as it should be such that MIDDLEWARES get executed.

文章来源: django-cors-headers not work