关于php：NGINX \\’Access-Control-Allow-Origin \\’标头包含多个值

NGINX 'Access-Control-Allow-Origin' header contains multiple values

我有一台具有PHP的NGINX服务器(假设主机名为http://myserver.com)。我有一个PHP脚本，可以从本地主机上的网页通过XHR访问。我正在将其用作类似于freegeoip.net的GeoIP服务器。

我正在尝试将XHR锁定到特定域。

这是我的配置设置：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

location ~ \\.php$ {
try_files $uri =404;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;

fastcgi_param GEOIP_COUNTRY_CODE $geoip2_data_country_code;
fastcgi_param GEOIP_COUNTRY_NAME $geoip2_data_country_name;
fastcgi_param GEOIP_COUNTRY_GEONAME_ID $geoip2_data_country_geoname_id;
fastcgi_param GEOIP_CITY_NAME $geoip2_data_city_name;
fastcgi_param GEOIP_CITY_GEONAME_ID $geoip2_data_city_geoname_id;
fastcgi_param GEOIP_CONTINENT_CODE $geoip2_data_city_continent_code;
fastcgi_param GEOIP_CONTINENT_GEONAME_ID $geoip2_data_city_continent_geoname_id;
fastcgi_param GEOIP_LATITUDE $geoip2_data_city_location_latitude;
fastcgi_param GEOIP_LONGITUDE $geoip2_data_city_location_longitude;
fastcgi_param GEOIP_TIME_ZONE $geoip2_data_city_location_timezone;
fastcgi_param GEOIP_ISP $geoip2_data_city_traits_isp;
fastcgi_param GEOIP_IP_ADDRESS $geoip2_data_city_traits_ip_address;

set $cors"";

if ($http_origin ~* 'https?://(www\\.domain1\\.com|www\\.domain2\\.com)')
{
set $cors"true";
}

if ($cors = 'true')
{
add_header 'Access-Control-Allow-Origin'"$http_origin";
add_header 'Access-Control-Allow-Credentials' 'true';
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,Pragma,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With';
}

if ($request_method = 'OPTIONS')
{
return 204;
}
}

我遇到的问题是，当我执行XHR请求时，出现以下错误：

XMLHttpRequest cannot load http://myserver.com/. The 'Access-Control-Allow-Origin' header contains multiple values '*, http://localhost', but only one is allowed. Origin 'http://localhost' is therefore not allowed access.

在配置文件中我只有一个对add_header 'Access-Control-Allow-Origin'"$http_origin";的调用，那么为什么有多个值？有什么方法可以禁用第一个呼叫，即*？

1。)让应用程序动态批准并添加响应头。

1
2
3
4
5
6
7

$allowed_domains = ['http://allowed.com','http://another_allowed.com'];

function add_cors_header() {
if (in_array($_SERVER['http_origin'], $allowed_domains)) {
header('Access-Control-Allow-Origin', $_SERVER['http_origin']);
}
}

2。)或安装启用了Lua的Nginx的OpenResty版本，并执行相同的操作，但在Nginx conf文件中使用Lua。