跨域资源共享 (CORS) 是否区分 HTTP 和 HTTPS?

2022-01-15 00:00:00 cors http xmlhttprequest javascript

我有两个网站:https//:www.domain-only-uses-https.com 和 www.domain-uses-both-http-and-https.com

I have two sites : https//:www.domain-only-uses-https.com and www.domain-uses-both-http-and-https.com

现在我在前者的页面中向后者发出2个ajax GET请求，一个是

Now I am making 2 ajax GET requests in the page of the former to the later, one is 

https://www.domain-uses-both-http-and-https.com/some-path  (using the HTTPS scheme)

另一个是

http://www.domain-uses-both-http-and-https.com/some-other-path (using the HTTP scheme)

我确实将https//:www.domain-only-uses-https.com"设置为服务器www.domain-uses-"中Access-Control-Allow-Origin:"标头的值http-和-https.com".

And I DID set the "https//:www.domain-only-uses-https.com" as the value of "Access-Control-Allow-Origin:" header in the server "www.domain-uses-both-http-and-https.com ".

但现在看来 Chrome 只允许请求 1，而请求 2 被禁止.

But now it seems that only request 1 is allowed by Chrome ,but request 2 is forbidden.

所以我的问题是:Access-Control-Allow-Origin"标头是否区分 HTTP 和 HTTPS?希望我已经说清楚了..

So my question is : does the "Access-Control-Allow-Origin" header differentiate between HTTP AND HTTPS? Hope I've made myself clear..

推荐答案

是的，HTTP 和 HTTPS 的来源不同.

Yes, HTTP and HTTPS origins are different.

origin 是 hostname、port 和 scheme 的组合.

An origin is a combination of hostname, port, and scheme.

  http://foo.example.com:8080/
  ^^^^   ^^^^^^^^^^^^^^^ ^^^^
   ||           ||        ||
 scheme      hostname    port

如果不是所有这些字段在两个资源之间都匹配，则这些资源来自不同的来源.因此，您必须明确指定资源是可以从使用 HTTP 方案的源访问还是使用 HTTPS 方案的源访问.

If not all of these fields match between two resources, then the resources are from different origins. Thus, you must expressly specify whether the resource is accessible from the origin with an HTTP scheme or the origin with an HTTPS scheme.

某些浏览器只允许 Access-Control-Allow-Origin 标头包含与每个响应一起发送的准确的一个来源(或 *)；但是，您的服务器可以检测到请求的 Origin 标头并在 CORS 响应中发送相同的来源.

Some browsers only allow the Access-Control-Allow-Origin header to contain exactly one origin (or *) sent with each response; however, your server can detect the request's Origin header and send the same origin in the CORS response.

相关文章