FrankKai
commented
6 years ago user crednetials
关键词：cookie CORS
- The term user credentials for the purposes of this specification means cookies, HTTP authentication, and client-side SSL certificates.
- user crednetials为true时，不允许Access-Allow-Control-Origin:*
- 前端需要设置user crednetials为true。以axios为例，设置withCredentials: true即可。
- 后端需要设置user credentials为true。以express为例，ccess-Control-Allow-Origin': req.headers.origin，Access-Control-Allow-Credentials: true即可。
规范定义如下：
6.2. Resource Sharing Check
The resource sharing check algorithm for a given resource is as follows:
1. If the response includes zero or more than one Access-Control-Allow-Origin header values return fail and terminate this algorithm.
2. If the Access-Control-Allow-Origin header value is the literal "*" character and the credentials flag is false return pass and terminate this algorithm.
3. If the value of Access-Control-Allow-Origin is not a case-sensitive match for the value of the Origin header as defined by its specification return fail and terminate this algorithm.
4. If the credentials flag is true and the response includes zero or more than one Access-Control-Allow-Credentials header values return fail and terminate this algorithm.
5. If the credentials flag is true and the Access-Control-Allow-Credentials header value is not a case-sensitive match for "true" return fail and terminate this algorithm.
6. Return pass.
The above algorithm also functions when the ASCII serialization of an origin is the string "null".常用于cookie用户验证。
HTTP(S知识点。