{# canonical_base is the OWNING tenant's origin: all 16 Peasy domains serve the same catalogue, so a page rendered by a non-owner points its canonical at the owner instead of competing with it. Falls back to this site for static/self-owned pages. #}
🍋
Menu
Web

CORS

CORS(跨源资源共享)

一种浏览器安全机制,允许网页从与自身来源不同的域请求资源(字体、API、图像),同时让服务器控制哪些来源被授权。

技术细节

CORS通过HTTP头工作:Access-Control-Allow-Origin指定允许的来源,Access-Control-Allow-Methods指定HTTP方法,Access-Control-Allow-Headers列出自定义头。"预检"OPTIONS请求用于非简单请求(PUT、DELETE或自定义头)。凭证请求需要Access-Control-Allow-Credentials: true且来源不能为通配符。

示例

```javascript
// CORS: web API example
const response = await fetch('/api/resource');
const data = await response.json();
console.log(data);
```

相关工具

相关术语