Apache 403根据当地的CORS要求禁止

我正在使用并试图通过CORS/AJAX请求（用于Angular应用程序）从

/.众所周知的/OpenID配置

端点获取OpenID连接配置。但是，当我尝试从本地托管的app/HTML文件请求端点时，XHR请求端点，我收到一个

403禁止的
错误

只有当请求源于本地上下文（即Angular的开发服务器或请求端点的本地HTML文件）时，才会发生这种情况。如果我打开执行AJAX请求的同一个HTML文件（托管在服务器上），它就会工作

测试HTML文件如下所示


var url='1〕https://example.com/.well-known/openid-configuration';
var req=新的XMLHttpRequest（）；
请求打开（'GET'，url，true）；
setRequestHeader（'Content-Type'，'application/json'）；
请求加载=（）=>{
如果（请求状态>=200&请求状态<400）{
log（“[XHR SUCCESS]”）；
var el=document.getElementById（'content'）；
el.innerHTML=req.responseText；
}否则{
log（“[XHR错误]”，req）；
}
}
req.onerror=（）=>{
log（“[XHR连接错误]”）；
}
请求发送（）；

从本地文件请求
如上所述，当从本地HTML文件请求时，我收到
403禁止
错误

在浏览器控制台（Chrome）中，输出两个错误：

Failed to load resource: the server responded with a status of 403 (Forbidden)

我在服务器上找到的与此相关的唯一输出位于文件
/var/log/apache2/other_vhosts_access.log
：

example.com:443 <IP> - - [11/Mar/2019:10:45:20 +0000] "OPTIONS /.well-known/openid-configuration HTTP/1.1" 403 3763 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"

从服务器承载的文件请求
当执行与上面完全相同的操作时，但使用托管在服务器上的HTML文件，请求将成功完成

访问日志中的输出：

example.com:443 <IP> - - [11/Mar/2019:11:06:46 +0000] "OPTIONS /.well-known/openid-configuration HTTP/1.1" 200 779 "http://example.org/xhr-cors.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"
example.com:443 <IP> - - [11/Mar/2019:11:06:46 +0000] "GET /.well-known/openid-configuration HTTP/1.1" 200 6629 "http://example.org/xhr-cors.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36"

Apache配置
服务器上Apache的配置为

<VirtualHost  *:80>
        ServerName example.com
        Redirect  / https://example.com/
        DocumentRoot "/var/www/html/"
RewriteEngine on
RewriteCond %{SERVER_NAME} =example.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443>
        DocumentRoot "/var/www/html/"
        ServerName example.com:443

        LogLevel warn
        SSLEngine on
        SSLProtocol -all +TLSv1.1 +TLSv1.2
        SSLHonorCipherOrder On
        SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-RSA-AES128-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

#               SetEnv proxy-nokeepalive 1
        SetEnv proxy-initial-not-pooled 1
        Timeout 60
                ProxyTimeout 60

        # Security headers
#        Header always append X-Frame-Options SAMEORIGIN
                Header always set X-Xss-Protection "1; mode=block"
                Header always set X-Content-Type-Options nosniff
#        Header always set Content-Security-Policy "default-src 'self' 'unsafe-inline' https://example.com"
        Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

        Header edit Set-Cookie ^((?!session_state).*)$ $1;HttpOnly
        SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

                # Unset X-ClientCert to make sure that we not get certificate in request
        RequestHeader unset X-ClientCert

                # Turn off support for true Proxy behaviour as we are acting as a transparent proxy
        ProxyRequests Off

                # Turn off VIA header as we know where the requests are proxied
        ProxyVia Off

                # Turn on Host header preservation so that the servlet container
                # can write links with the correct host and rewriting can be avoided.
        ProxyPreserveHost On

                # Preserve the scheme when proxying the request to Jetty
                RequestHeader set X-Forwarded-Proto "https" env=HTTPS

                Header unset ETag
        FileETag None

        RedirectMatch ^(/)$ /identity/

                # Set the permissions for the proxy
                <Proxy *>
                  AddDefaultCharset off
                  Order deny,allow
                  Allow from all
                </Proxy>

        <Location /oxauth>
                ProxyPass http://localhost:8081/oxauth retry=5 connectiontimeout=60 timeout=60
#                Header set Access-Control-Allow-Origin "*"
                Order deny,allow
                Allow from all
        </Location>

        <LocationMatch /oxauth/auth/cert/cert-login>
            SSLVerifyClient optional_no_ca
            SSLVerifyDepth 10
            SSLOptions -StdEnvVars +ExportCertData

                        # Forward certificate to destination server
            RequestHeader set X-ClientCert %{SSL_CLIENT_CERT}s
        </LocationMatch>

        <Location /idp>
                ProxyPass http://localhost:8086/idp retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /identity>
                ProxyPass http://localhost:8082/identity retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /cas>
                ProxyPass http://localhost:8083/cas retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /oxauth-rp>
                ProxyPass http://localhost:8085/oxauth-rp retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /asimba>
                ProxyPass http://localhost:8084/asimba retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /passport>
                ProxyPass http://localhost:8090/passport retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /casa>
                ProxyPass http://localhost:8091/casa retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

       <LocationMatch "/.well-known/openid-configuration">
               ProxyPass http://localhost:8081/oxauth/.well-known/openid-configuration
               Header set Access-Control-Allow-Origin "*"
       </LocationMatch>

#                        ProxyPass /.well-known/openid-configuration http://localhost:8081/oxauth/.well-known/openid-configuration
ProxyPass /.well-known/simple-web-discovery http://localhost:8081/oxauth/.well-known/simple-web-discovery
ProxyPass        /.well-known/webfinger http://localhost:8081/oxauth/.well-known/webfinger
        ProxyPass        /.well-known/uma2-configuration http://localhost:8081/oxauth/restv1/uma2-configuration
        ProxyPass        /.well-known/fido-configuration http://localhost:8081/oxauth/restv1/fido-configuration
        ProxyPass        /.well-known/fido-u2f-configuration http://localhost:8081/oxauth/restv1/fido-configuration
        ProxyPass        /.well-known/scim-configuration http://localhost:8082/identity/restv1/scim-configuration
        ServerAlias        example.com
        SSLCertificateFile        /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

指令，并介绍了

<LocationMatch "/.well-known/openid-configuration">
        ProxyPass http://localhost:8081/oxauth/.well-known/openid-configuration
        Header set Access-Control-Allow-Origin "*"
</LocationMatch>


ProxyPasshttp://localhost:8081/oxauth/.well-已知/openid配置
标题集访问控制允许原点“*”

添加CORS标头的指令

其他
我试图找出问题所在的其他方面：


通过邮递员向端点执行了
GET
请求，该请求已成功完成
通过邮递员向端点执行
OPTIONS
请求，该请求已成功完成

我非常感谢您在这方面的一些意见，因为这让我非常困惑，而且在开发过程中无法从本地工作是很麻烦的。如果需要任何澄清，请让我知道。
事实证明，这个问题是两个不相关事物的结合

首先，这主要是猜测，似乎Chrome阻止了来自本地文件（HTML文件）的请求，并简单地提供了输出，这对我来说非常混乱。也就是说，
403
错误可能是因为Chrome以某种方式阻止了CORS请求。我尝试使用各种标志运行Chrome，例如，
--禁用web安全
和
--允许从文件访问文件
，但这并没有改变本地HTML文件的输出。因此，本地文件请求仍然失败，我不知道确切原因。但是，因为这只是为了测试，所以对我来说，目前没有那么重要

其次，Angular项目中拦截器中的错误实现重写了请求的所有头。修复此问题后，本地服务器能够请求端点

碰巧这两个不同版本的输出看起来几乎一样，这让我很反感。
我不确定gluu方面，但你可以尝试chrome cors插件来启用它：@Jingwei这不是确切的答案，但是，您的建议确实让我第五次（或差不多）检查了请求和响应标题，从而使我走上了正确的道路。非常感谢。
OPTIONS /.well-known/openid-configuration HTTP/1.1|Host:example.com|Connection:keep-alive|Access-Control-Request-Method:GET|Origin:http%3a//example.org|User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36|Access-Control-Request-Headers:content-type|Accept:*/*|Referer:http%3a//example.org/xhr-cors.html|Accept-Encoding:gzip, deflate, br|Accept-Language:en-US,en;q=0.9

GET /.well-known/openid-configuration HTTP/1.1|Host:example.com|Connection:keep-alive|Origin:http%3a//example.org|User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36|Content-Type:application/json|Accept:*/*|Referer:http%3a//example.org/xhr-cors.html|Accept-Encoding:gzip, deflate, br|Accept-Language:en-US,en;q=0.9

<VirtualHost  *:80>
        ServerName example.com
        Redirect  / https://example.com/
        DocumentRoot "/var/www/html/"
RewriteEngine on
RewriteCond %{SERVER_NAME} =example.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443>
        DocumentRoot "/var/www/html/"
        ServerName example.com:443

        LogLevel warn
        SSLEngine on
        SSLProtocol -all +TLSv1.1 +TLSv1.2
        SSLHonorCipherOrder On
        SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-RSA-AES128-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

#               SetEnv proxy-nokeepalive 1
        SetEnv proxy-initial-not-pooled 1
        Timeout 60
                ProxyTimeout 60

        # Security headers
#        Header always append X-Frame-Options SAMEORIGIN
                Header always set X-Xss-Protection "1; mode=block"
                Header always set X-Content-Type-Options nosniff
#        Header always set Content-Security-Policy "default-src 'self' 'unsafe-inline' https://example.com"
        Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

        Header edit Set-Cookie ^((?!session_state).*)$ $1;HttpOnly
        SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

                # Unset X-ClientCert to make sure that we not get certificate in request
        RequestHeader unset X-ClientCert

                # Turn off support for true Proxy behaviour as we are acting as a transparent proxy
        ProxyRequests Off

                # Turn off VIA header as we know where the requests are proxied
        ProxyVia Off

                # Turn on Host header preservation so that the servlet container
                # can write links with the correct host and rewriting can be avoided.
        ProxyPreserveHost On

                # Preserve the scheme when proxying the request to Jetty
                RequestHeader set X-Forwarded-Proto "https" env=HTTPS

                Header unset ETag
        FileETag None

        RedirectMatch ^(/)$ /identity/

                # Set the permissions for the proxy
                <Proxy *>
                  AddDefaultCharset off
                  Order deny,allow
                  Allow from all
                </Proxy>

        <Location /oxauth>
                ProxyPass http://localhost:8081/oxauth retry=5 connectiontimeout=60 timeout=60
#                Header set Access-Control-Allow-Origin "*"
                Order deny,allow
                Allow from all
        </Location>

        <LocationMatch /oxauth/auth/cert/cert-login>
            SSLVerifyClient optional_no_ca
            SSLVerifyDepth 10
            SSLOptions -StdEnvVars +ExportCertData

                        # Forward certificate to destination server
            RequestHeader set X-ClientCert %{SSL_CLIENT_CERT}s
        </LocationMatch>

        <Location /idp>
                ProxyPass http://localhost:8086/idp retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /identity>
                ProxyPass http://localhost:8082/identity retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /cas>
                ProxyPass http://localhost:8083/cas retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /oxauth-rp>
                ProxyPass http://localhost:8085/oxauth-rp retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /asimba>
                ProxyPass http://localhost:8084/asimba retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /passport>
                ProxyPass http://localhost:8090/passport retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

        <Location /casa>
                ProxyPass http://localhost:8091/casa retry=5 connectiontimeout=60 timeout=60
                Order deny,allow
                Allow from all
        </Location>

       <LocationMatch "/.well-known/openid-configuration">
               ProxyPass http://localhost:8081/oxauth/.well-known/openid-configuration
               Header set Access-Control-Allow-Origin "*"
       </LocationMatch>

#                        ProxyPass /.well-known/openid-configuration http://localhost:8081/oxauth/.well-known/openid-configuration
ProxyPass /.well-known/simple-web-discovery http://localhost:8081/oxauth/.well-known/simple-web-discovery
ProxyPass        /.well-known/webfinger http://localhost:8081/oxauth/.well-known/webfinger
        ProxyPass        /.well-known/uma2-configuration http://localhost:8081/oxauth/restv1/uma2-configuration
        ProxyPass        /.well-known/fido-configuration http://localhost:8081/oxauth/restv1/fido-configuration
        ProxyPass        /.well-known/fido-u2f-configuration http://localhost:8081/oxauth/restv1/fido-configuration
        ProxyPass        /.well-known/scim-configuration http://localhost:8082/identity/restv1/scim-configuration
        ServerAlias        example.com
        SSLCertificateFile        /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

ProxyPass /.well-known/openid-configuration http://localhost:8081/oxauth/.well-known/openid-configuration

<LocationMatch "/.well-known/openid-configuration">
        ProxyPass http://localhost:8081/oxauth/.well-known/openid-configuration
        Header set Access-Control-Allow-Origin "*"
</LocationMatch>