Javascript 快速CORS子域
我有一个网站-Javascript 快速CORS子域,javascript,node.js,express,cors,Javascript,Node.js,Express,Cors,我有一个网站-https://example.com-调用API的调用-https://api.example.com-。API是用Express编写的，它用于允许来自站点的请求： app.use( cors({ credentials: true, origin: "https://example.com", }) ); 可通过https://example.com或通过https://www.example.com。如您所见，在API中，我显
https://example.comhttps://api.example.comapp.use(
cors({
credentials: true,
origin: "https://example.com",
})
);
https://example.comhttps://www.example.comhttps://example.comhttps://www.example.comwwwhttps://www.example.comapp.use(
cors({
credentials: true,
origin: ["https://example.com", "https://www.example.com"],
})
);
.htaccesswwwwww但现在的问题是：为什么甚至允许
www.example.comwww.example.comexample.com显式允许两个
https://example.comhttps://www.example.comoriginoriginhttps://example.comhttps://www.example.comhttps://example.comhttps://www.example.comhttps://www.example.comhttps://（www.example.comhttps://example.comhttps://www.example.com*.htaccesswwwwwwwww.example.comorigin:[”的数组传递吗https://example.com", "https://www.example.com“]app.use(
cors({
credentials: true,
origin: function (origin callback) {
switch (origin) {
case "https://example.com":
case "https://www.example.com":
callback(null, true); // allow these domains
break;
default:
callback(new Error('Now allowed')); // block others
}
},
})
);