zoukankan      html  css  js  c++  java
  • [HTTP] Origins, CROS, Preflight

    Origins made up of three parts the data scheme, the hostname and the prot.

    It is important to know that it is user broswere enforces the same origin policy, it is the client browser not allow you send the different origin request not the server. 

    CROS:

    Client side send the request, server side will check wheterh "Access-Control-Allow-Origin" is the same as "Referer". 

    One problem for this is request is already send to server, include all the data. What we want is from client side, we just sent the min-info to check the CROS, instead of sending business data. 

    So there is Preflight request comes in to play.

    Preflight request:

    It sends OPTIONS methoda and with "Referer", so server only needs to check "Referer" and return "ACAO".

    To check whether a request is a Preflight request, you need to see whether it has "OPTIONS" method in the request head.

    But notice, if a request is come from a form , then it cannot be preflight. See MORE

    Preflighted requests

    Unlike simple requests (discussed above), "preflighted" requests first send an HTTP request by theOPTIONS method to the resource on the other domain, in order to determine whether the actual request is safe to send.  Cross-site requests are preflighted like this since they may have implications to user data.  In particular, a request is preflighted if:

    • It uses methods other than GET, HEAD or POST.  Also, if POST is used to send request data with a Content-Type other than application/x-www-form-urlencodedmultipart/form-data, ortext/plain, e.g. if the POST request sends an XML payload to the server using application/xmlor text/xml, then the request is preflighted.
    • It sets custom headers in the request (e.g. the request uses a header such as X-PINGOTHER)
  • 相关阅读:
    AAC音频格式分析与解码
    SIGPIPE信号
    可变参数的宏定义
    Makefile条件编译debug版和release版
    Linux下查看内存使用情况
    Trie树 字典树
    C/C++随机数生成 rand() srand()
    关于编译安装Thrift找不到libthriftnb.a的问题
    Linux下使用popen()执行shell命令
    WebSocket协议分析
  • 原文地址:https://www.cnblogs.com/Answer1215/p/5639330.html
Copyright © 2011-2022 走看看