CORS

Cross-Origin Resource Sharing

keywords

단순 요청(Simple requests)(https://developer.mozilla.org/ko/docs/Web/HTTP/CORS#단순_요청simple_requests)은 Origin(HTTP Header)에 요청하는 도메인을 넣고, 서버는 Access-Control-Allow-Origin 헤더에 * 혹은 허용하는 도메인을 넣어 응답한다.

GET 메서드 이외에 대하여 OPTIONS 메서드를 사용하여 preflight하여 지원하는 메서드를 요청한다. (https://developer.mozilla.org/ko/docs/Web/HTTP/CORS#프리플라이트_요청)

OPTIONS /resources/post-here/ HTTP/1.1
Host: bar.other
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Connection: keep-alive
Origin: http://foo.example
Access-Control-Request-Method: POST
Access-Control-Request-Headers: X-PINGOTHER, Content-Type

HTTP/1.1 204 No Content
Date: Mon, 01 Dec 2008 01:15:39 GMT
Server: Apache/2
Access-Control-Allow-Origin: https://foo.example
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Headers: X-PINGOTHER, Content-Type
Access-Control-Max-Age: 86400
Vary: Accept-Encoding, Origin
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive

nginx에서 CORS에 대하여 설정할 수 있다.

외부링크

https://developer.mozilla.org/ko/docs/Web/HTTP/CORS