Flask

安裝外掛

pip install flask-cors

使用 CORS函式配置全域性路由

from flask_cors import *

app = Flask(__name__)

CORS(app, supports_credentials=True)

from flask_cors import CORS

app = Flask(__name__,)

# r'/*' 是萬用字元，讓本伺服器所有的URL 都允許跨域請求

CORS(app, resources=r'/*')

# 上傳檔案

@uploadFiles.route('/upload', methods=['POST'])

def uploadFile():

	result_text = {"statusCode": 200,"message": "檔案上傳成功"}

	response = make_response(jsonify(result_text))

    response.headers['Access-Control-Allow-Origin'] = '*'

    response.headers['Access-Control-Allow-Methods'] = 'OPTIONS,HEAD,GET,POST'

    response.headers['Access-Control-Allow-Headers'] = 'x-requested-with'

    return response

Django

安裝外掛

pip install django-cors-headers

新增APP

INSTALLED_APPS = (

    'corsheaders',

)

新增中介軟體

MIDDLEWARE = [

    'corsheaders.middleware.CorsMiddleware', #最好新增至第一行

]

配置白名單

#單個配置

CORS_ORIGIN_WHITELIST  =(

     ' 域名',

)

#正則配置:

CORS_ORIGIN_REGEX_WHITELIST  =(r'^(https?://)?（\w+\.)?jim\.com $',)

或者直接允許所有主機跨域

CORS_ORIGIN_ALLOW_ALL = True 預設為False

允許攜帶cookie

CORS_ALLOW_CREDENTIALS = True

請求頭及請求方法的配置：

#預設可以使用的非標準請求頭，需要使用自定義請求頭時，就可以進行修改

CORS_ALLOW_HEADERS = (

    'accept',

    'accept-encoding',

    'authorization',

    'content-type',

    'dnt',

    'origin',

    'user-agent',

    'x-csrftoken',

    'x-requested-with',

)

#預設請求方法

CORS_ALLOW_METHODS = (

    'DELETE',

    'GET',

    'OPTIONS',

    'PATCH',

    'POST',

    'PUT',

)

防止CSRF

#新增信任的站點 django1.9引入

CSRF_TRUSTED_ORIGINS = (

    'change.allowed.com',

)

更多配置詳情點選這裡

Tornado

解決方案

import tornado.web

class BaseHandler(tornado.web.RequestHandler):

    def __init__(self,*args,**kwargs):

        super().__init__(*args,**kwargs)

        self.host = ""

        self.port = ""

        # 在初始化方法中新增設定跨域的方法

        self.set_default_headers()

    # 處理OPTIONS域檢請求

    def post(self):

        self.set_status(204)

        self.finish()

    # 設定跨域的具體方法

    def set_default_headers(self):

        super().set_default_headers()

        # 設定允許的請求頭

        self.set_header("Access-Control-Allow-Methods","GET,POST,PUT,DELETE,OPTIONS")

        self.set_header("X-XSS-Protecion","1")

        self.set_header("Content-Security-Policy","default-src 'self'")

        self.set_header("Access-Control-Allow-Credentials","true")

        # 設定一些自己定義的請求頭

        self.set_header("Access-Control-Allow-Headers",

                        "Content-Type,Access-Control-Allow-Headers,X-Auth-Token,Y-Auth-Token"

            )

        self.set_header("Content-Type","application/json; charset=UTF-8")

        # 設定允許本地除錯的域名通過！

        self.set_header("Access-Control-Allow-Origin",self.request.headers.get("Origin","http://localhost:9090"))

        # 如果後面的域名設定為 * ，表示允許所有的域名通過

        # self.set_header("Access-Control-Allow-Origin","*")

        # self.set_header("Access-Control-Allow-Origin",self.request.headers.get("Origin","*"))

呼叫

class InterFaceHandler(BaseHandler):

    def set_default_headers(self):

        self.allowMyOrigin()

    def get(self, *args, **kwargs):

        pass