Cross-Origin Request Blocked [跨域请求封锁] - 问题-字节技术
Cross-Origin Request Blocked
跨域请求封锁
问题 (Question)
So I've got this Go http handler that stores some POST content into the datastore and retrieves some other info in response. On the back-end I use:
func handleMessageQueue(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Access-Control-Allow-Origin", "*")
if r.Method == "POST" {
c := appengine.NewContext(r)
body, _ := ioutil.ReadAll(r.Body)
auth := string(body[:])
r.Body.Close()
q := datastore.NewQuery("Message").Order("-Date")
var msg []Message
key, err := q.GetAll(c, &msg)
if err != nil {
c.Errorf("fetching msg: %v", err)
w.Header().Set("Content-Type", "application/json")
jsonMsg, err := json.Marshal(msg)
msgstr := string(jsonMsg)
fmt.Fprint(w, msgstr)
In my firefox OS app I use:
var message = "content";
request = new XMLHttpRequest();
request.open('POST', 'http://localhost:8080/msgs', true);
request.onload = function () {
if (request.status &= 200 && request.status & 400) {
// Success!
data = JSON.parse(request.responseText);
console.log(data);
// We reached our target server, but it returned an error
console.log("server error");
request.onerror = function () {
// There was a connection error of some sort
console.log("connection error");
request.send(message);
The incoming part all works along and such. However, my response is getting blocked. Giving me the following message:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:8080/msgs. This can be fixed by moving the resource to the same domain or enabling CORS.
I tried a lot of other things but there is no way I can just get a response from the server. However when I change my Go POST method into GET and access the page through the browser I get the data that I want so bad. I can't really decide which side goes wrong and why: it might be that Go shouldn't block these kinds of requests, but it also might be that my javascript is illegal.
所以我有这个HTTP处理程序去存储一些内容为数据存储和检索等信息的反应。在后端使用：func handleMessageQueue(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Access-Control-Allow-Origin", "*")
if r.Method == "POST" {
c := appengine.NewContext(r)
body, _ := ioutil.ReadAll(r.Body)
auth := string(body[:])
r.Body.Close()
q := datastore.NewQuery("Message").Order("-Date")
var msg []Message
key, err := q.GetAll(c, &msg)
if err != nil {
c.Errorf("fetching msg: %v", err)
w.Header().Set("Content-Type", "application/json")
jsonMsg, err := json.Marshal(msg)
msgstr := string(jsonMsg)
fmt.Fprint(w, msgstr)
我用在我的Firefox OS应用：var message = "content";
request = new XMLHttpRequest();
request.open('POST', 'http://localhost:8080/msgs', true);
request.onload = function () {
if (request.status &= 200 && request.status & 400) {
// Success!
data = JSON.parse(request.responseText);
console.log(data);
// We reached our target server, but it returned an error
console.log("server error");
request.onerror = function () {
// There was a connection error of some sort
console.log("connection error");
request.send(message);
输入部分的所有作品，如。然而，我的反应是堵住了。给我以下信息：Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:8080/msgs. This can be fixed by moving the resource to the same domain or enabling CORS.
我试过很多其他的东西，但也没有办法，我只能从服务器的响应。然而当我改变我的方法去获得通过后进入我所得到的数据，我想的那么坏的浏览器访问页面。我真的不能决定哪一方出错原因：这可能是去不应该阻止这些请求，但它也可能是我的JavaScript是非法的。
最佳答案 (Best Answer)
@Egidius, when creating an XMLHttpRequest, you should use
var xhr = new XMLHttpRequest({mozSystem: true});
What is mozSystem?
mozSystem Boolean: Setting this flag to true allows making cross-site connections without requiring the server to opt-in using CORS. Requires setting mozAnon: true, i.e. this can't be combined with sending cookies or other user credentials. This only works in privileged (reviewed) it does not work on arbitrary webpages loaded in Firefox.
Changes to your Manifest
On your manifest, do not forget to include this line on your permissions:
"permissions": {
"systemXHR" : {},
“egidius，创建XMLHttpRequest的时候，你应该使用var xhr = new XMLHttpRequest({mozSystem: true});
mozsystem是什么？mozsystem布尔：设置此标志为true允许跨站点的连接而无需服务器选择使用CORS。需要设置mozanon：真的，即不能结合送饼干或其他用户的凭据。这仅在特权（审查）的应用程序；它不工作在任意网页加载在Firefox。你的表现的变化在你的清单，不要忘了包括线在你的权限："permissions": {
"systemXHR" : {},}
答案 (Answer) 2
You need other headers, not only access-control-allow-origin.
If your request have the "Access-Control-Allow-Origin" header, you must copy it into the response headers, If doesn't, you must check the "Origin" header and copy it into the response. If your request doesn't have Access-Control-Allow-Origin not Origin headers, you must return "*".
You can read the complete explanation here:
and this is the function I'm using to write cross domain headers:
func writeCrossDomainHeaders(w http.ResponseWriter, req *http.Request) {
// Cross domain headers
if acrh, ok := req.Header["Access-Control-Request-Headers"]; ok {
w.Header().Set("Access-Control-Allow-Headers", acrh[0])
w.Header().Set("Access-Control-Allow-Credentials", "True")
if acao, ok := req.Header["Access-Control-Allow-Origin"]; ok {
w.Header().Set("Access-Control-Allow-Origin", acao[0])
if _, oko := req.Header["Origin"]; oko {
w.Header().Set("Access-Control-Allow-Origin", req.Header["Origin"][0])
w.Header().Set("Access-Control-Allow-Origin", "*")
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE")
w.Header().Set("Connection", "Close")
你需要其他的标题，不仅访问控制允许的起源。如果您的要求有“访问控制允许起源”的标题，你必须把它复制到响应头，如果没有，你必须检查“起源”头，把它复制到。如果您的要求没有访问控制允许非起源起源的标题，你必须返回“*”。你可以在这里阅读完整的解释：这是我用写跨域标题的功能：func writeCrossDomainHeaders(w http.ResponseWriter, req *http.Request) {
// Cross domain headers
if acrh, ok := req.Header["Access-Control-Request-Headers"]; ok {
w.Header().Set("Access-Control-Allow-Headers", acrh[0])
w.Header().Set("Access-Control-Allow-Credentials", "True")
if acao, ok := req.Header["Access-Control-Allow-Origin"]; ok {
w.Header().Set("Access-Control-Allow-Origin", acao[0])
if _, oko := req.Header["Origin"]; oko {
w.Header().Set("Access-Control-Allow-Origin", req.Header["Origin"][0])
w.Header().Set("Access-Control-Allow-Origin", "*")
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE")
w.Header().Set("Connection", "Close")
本文翻译自StackoverFlow，英语好的童鞋可直接参考原文：}