zoukankan      html  css  js  c++  java
  • [HTTP] Origins, CROS, Preflight

    Origins made up of three parts the data scheme, the hostname and the prot.

    It is important to know that it is user broswere enforces the same origin policy, it is the client browser not allow you send the different origin request not the server. 

    CROS:

    Client side send the request, server side will check wheterh "Access-Control-Allow-Origin" is the same as "Referer". 

    One problem for this is request is already send to server, include all the data. What we want is from client side, we just sent the min-info to check the CROS, instead of sending business data. 

    So there is Preflight request comes in to play.

    Preflight request:

    It sends OPTIONS methoda and with "Referer", so server only needs to check "Referer" and return "ACAO".

    To check whether a request is a Preflight request, you need to see whether it has "OPTIONS" method in the request head.

    But notice, if a request is come from a form , then it cannot be preflight. See MORE

    Preflighted requests

    Unlike simple requests (discussed above), "preflighted" requests first send an HTTP request by theOPTIONS method to the resource on the other domain, in order to determine whether the actual request is safe to send.  Cross-site requests are preflighted like this since they may have implications to user data.  In particular, a request is preflighted if:

    • It uses methods other than GET, HEAD or POST.  Also, if POST is used to send request data with a Content-Type other than application/x-www-form-urlencodedmultipart/form-data, ortext/plain, e.g. if the POST request sends an XML payload to the server using application/xmlor text/xml, then the request is preflighted.
    • It sets custom headers in the request (e.g. the request uses a header such as X-PINGOTHER)
  • 相关阅读:
    Linux system basic 2 + add kernel for Jupyter
    Linux package installation: deb and rpm
    classification tips 01: npy file
    how to activate XMind8 to pro version.
    Linux system 初步
    try_except_finally
    Postgresql Json Sql
    python package install error and little code bugs
    小程序用户操作事件
    套数据操作步骤
  • 原文地址:https://www.cnblogs.com/Answer1215/p/5639330.html
Copyright © 2011-2022 走看看