Javascript CORS错误-我的标题

在问这个问题之前，我试图做我的家庭作业，但我看不到我的标题中缺少什么

我在javascript中设置了以下标题：

xhr.setRequestHeader('Access-Control-Allow-Headers', 'Origin, Accept, Content-Type, Access-Control-Allow-Origin');
xhr.setRequestHeader('Access-Control-Allow-Origin', '*');
xhr.setRequestHeader('Access-Control-Allow-Methods', 'GET,POST');
xhr.setRequestHeader('Content-Type', 'application/json');

xhttp.setRequestHeader("Content-Type", "application/json; charset=UTF-8");
xhttp.setRequestHeader("Access-Control-Allow-Origin", "*");
xhttp.setRequestHeader("Access-Control-Allow-Methods", "GET, POST, PUT, OPTIONS");
xhttp.setRequestHeader("Access-Control-Allow-Headers", "Content-Type");
xhttp.setRequestHeader("Access-Control-Request-Headers", "X-Requested-With, accept, content-type");

服务器发送带有响应的标题：

Pragma: no-cache
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: PUT, GET, POST, OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Max-Age: 86400
Transfer-Encoding: chunked
Cache-Control: no-store, must-revalidate, no-cache, post-check=0, pre-check=0
Date: Wed, 15 Mar 2017 03:39:49 GMT
Set-Cookie: PHPSESSID=1ng3l10lvrrovlmdbij5chv2f5; path=/
Server: Apache
Content-Type: application/json
Expires: Thu, 19 Nov 1981 08:52:00 GMT

但我在浏览器（FF和Chrome）中发现了错误：

已阻止跨源请求：同一源策略不允许读取位于的远程资源。（原因：CORS飞行前通道的CORS标头“访问控制允许标头”中缺少令牌“访问控制允许标头”）

---

有人能看出我遗漏了什么吗？

这个解决方案似乎很有效

if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {

    if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) && $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] == 'POST') {
        header('Access-Control-Allow-Origin: *');
        header('Access-Control-Allow-Headers: X-Requested-With, content-type, access-control-allow-origin, access-control-allow-methods, access-control-allow-headers');
    }
    exit;
}

header('Content-type: application/json');
header('Access-Control-Allow-Origin: *');

Javascript:

xhr.setRequestHeader('Access-Control-Allow-Headers', 'Origin, Accept, Content-Type, Access-Control-Allow-Origin');
xhr.setRequestHeader('Access-Control-Allow-Origin', '*');
xhr.setRequestHeader('Access-Control-Allow-Methods', 'GET,POST');
xhr.setRequestHeader('Content-Type', 'application/json');

xhttp.setRequestHeader("Content-Type", "application/json; charset=UTF-8");
xhttp.setRequestHeader("Access-Control-Allow-Origin", "*");
xhttp.setRequestHeader("Access-Control-Allow-Methods", "GET, POST, PUT, OPTIONS");
xhttp.setRequestHeader("Access-Control-Allow-Headers", "Content-Type");
xhttp.setRequestHeader("Access-Control-Request-Headers", "X-Requested-With, accept, content-type");

---

这个解决方案似乎很有效

if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {

    if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD']) && $_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'] == 'POST') {
        header('Access-Control-Allow-Origin: *');
        header('Access-Control-Allow-Headers: X-Requested-With, content-type, access-control-allow-origin, access-control-allow-methods, access-control-allow-headers');
    }
    exit;
}

header('Content-type: application/json');
header('Access-Control-Allow-Origin: *');

Javascript:

xhr.setRequestHeader('Access-Control-Allow-Headers', 'Origin, Accept, Content-Type, Access-Control-Allow-Origin');
xhr.setRequestHeader('Access-Control-Allow-Origin', '*');
xhr.setRequestHeader('Access-Control-Allow-Methods', 'GET,POST');
xhr.setRequestHeader('Content-Type', 'application/json');

xhttp.setRequestHeader("Content-Type", "application/json; charset=UTF-8");
xhttp.setRequestHeader("Access-Control-Allow-Origin", "*");
xhttp.setRequestHeader("Access-Control-Allow-Methods", "GET, POST, PUT, OPTIONS");
xhttp.setRequestHeader("Access-Control-Allow-Headers", "Content-Type");
xhttp.setRequestHeader("Access-Control-Request-Headers", "X-Requested-With, accept, content-type");

---

Access Control Allow-*

头在客户端上没有意义-它们是服务器必须响应的头，您的客户端才能获得使用其他人资源的权限-删除请求中的

Access Control Allow-*

，因为您的服务器似乎正常，只是服务器不允许在请求中使用那些不正确的头。顺便说一句，错误消息中清楚地说明了问题<代码>原因：CORS飞行前频道的CORS标头“access control allow headers”中缺少令牌“access control allow headers”-因此，只需去掉无意义的请求标头（前3个），尤其是去掉这一个access control allow Origin:*。它允许客户端上的所有内容和所有人

Access Control Allow-*

头都没有意义-它们是服务器必须响应的头，您的客户端才能获得使用其他人资源的权限-删除请求中的

Access Control Allow-*

，因为您的服务器似乎正常，只是服务器不允许在请求中使用那些不正确的头。顺便说一句，错误消息中清楚地说明了问题<代码>原因：CORS飞行前频道的CORS标头“access control allow headers”中缺少令牌“access control allow headers”-因此，只需去掉无意义的请求标头（前3个），尤其是去掉这一个access control allow Origin:*。它允许一切和每个人