symfonyapi、Reactjs和Nginx:No'；访问控制允许原点'；生产中请求的资源上存在标头

我有两个应用程序在nginx服务器上运行：我的symfonyapi:*****.com和我的React应用程序：*****.com

我正在使用jwt身份验证，但由于cors策略，我无法连接到我的API。 nelmio cors捆绑包也不起作用，但邮递员没有问题

我的nelmio cors配置：

nelmio_cors:
    defaults:
        origin_regex: true
        allow_origin: ['%env(CORS_ALLOW_ORIGIN)%']
        allow_methods: ['GET', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE']
        allow_headers: ['Content-Type', 'Authorization']
        expose_headers: ['Link']
        max_age: 3600
    paths:
        '^/api/':
            allow_origin: ['*']
            allow_headers: ['*']
            allow_methods: ['POST', 'PUT', 'GET', 'DELETE']
            max_age: 3600

我的nginx配置：

  location / {
    if ($request_method = 'OPTIONS') {
      add_header 'Access-Control-Allow-Origin' '*';
      add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
      #
      # Custom headers and headers various browsers *should* be OK with but aren't
      #
      add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
      #
      # Tell client that this pre-flight info is valid for 20 days
      #
      add_header 'Access-Control-Max-Age' 1728000;
      add_header 'Content-Type' 'text/plain; charset=utf-8';
      add_header 'Content-Length' 0;
      return 204;
    }
    try_files $uri /index.php$is_args$args;
  }

我的浏览器显示的内容：

Request Headers:
:authority: dev-api******.com
:method: OPTIONS
:path: /api/1.0/login_check
:scheme: https
accept: */ *
accept-encoding: gzip, deflate, br
accept-language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7
access-control-request-headers: content-type
access-control-request-method: POST
origin: https://dev-front******.com
referer: https://dev-front******.com
sec-fetch-mode: cors
sec-fetch-site: same-site
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36

---

我已经更改了我的nginx配置，现在我有一个404错误

server {
  listen 80;

  server_name dev-api*******.com;
  root /var/www/project/current/public;

  location / {
    if ($request_method = 'OPTIONS') {
      add_header 'Access-Control-Allow-Origin' '*';
      add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
      #
      # Custom headers and headers various browsers *should* be OK with but aren't
      #
      add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
      #
      # Tell client that this pre-flight info is valid for 20 days
      #
      add_header 'Access-Control-Max-Age' 1728000;
      add_header 'Content-Type' 'text/plain; charset=utf-8';
      add_header 'Content-Length' 0;
      return 204;
    }
    try_files $uri /index.php$is_args$args;
  }

  # DEV
  # This rule should only be placed on your development environment
  # In production, don't include this and don't deploy index_dev.php or config.php
  location ~ ^/index\.php(/|$) {
    fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
    fastcgi_split_path_info ^(.+\.php)(/.*)$;
    include fastcgi_params;
    # When you are using symlinks to link the document root to the
    # current version of your application, you should pass the real
    # application path instead of the path to the symlink to PHP
    # FPM.
    # Otherwise, PHP's OPcache may not properly detect changes to
    # your PHP files (see https://github.com/zendtech/ZendOptimizerPlus/issues/126
    # for more information).
    fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
    fastcgi_param DOCUMENT_ROOT $realpath_root;
    # Prevents URIs that include the front controller. This will 404:
    # http://domain.tld/app.php/some-path
    # Remove the internal directive to allow URIs like this
    internal;
  }

  location ~ \.php$ {
    return 404;
  }

  error_log /var/log/nginx/project_error.log;
  access_log /var/log/nginx/project_access.log;
}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  server_name dev-api******.com;
  root /var/www/project/current/public;

  ssl_session_cache     shared:SSL:1m;
  ssl_session_timeout   10m;
  ssl_ciphers       HIGH:!aNULL:!MD5;
  ssl_prefer_server_ciphers on;

  location / {
    if ($request_method = OPTIONS) { 
      add_header 'Access-Control-Allow-Origin' 'https://dev-front******.com' always;
      add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
      add_header 'Access-Control-Allow-Credentials' 'true' always;
      add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With';
      add_header 'Access-Control-Max-Age' 1728000;

      add_header 'Content-Type' 'text/plain; charset=utf-8';
      add_header 'Content-Length' 0;
      return 204;
    }
  if ($request_method = POST) {
      add_header 'Access-Control-Allow-Origin' 'https://dev-front******.com' always;
      add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
      add_header 'Access-Control-Allow-Credentials' 'true' always;
      add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With';
      add_header 'Access-Control-Max-Age' 1728000;
    }
    if ($request_method = GET) {
      add_header 'Access-Control-Allow-Origin' 'https://dev-front******.com' always;
      add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
      add_header 'Access-Control-Allow-Credentials' 'true' always;
      add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With';
      add_header 'Access-Control-Max-Age' 1728000;
    } 
  }

  location ~ ^/index\.php(/|$) {
    fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
    fastcgi_split_path_info ^(.+\.php)(/.*)$;
    include fastcgi_params;
    # When you are using symlinks to link the document root to the
    # current version of your application, you should pass the real
    # application path instead of the path to the symlink to PHP
    # FPM.
    # Otherwise, PHP's OPcache may not properly detect changes to
    # your PHP files (see https://github.com/zendtech/ZendOptimizerPlus/issues/126
    # for more information).
    fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
    fastcgi_param DOCUMENT_ROOT $realpath_root;
    # Prevents URIs that include the front controller. This will 404:
    # http://domain.tld/app.php/some-path
    # Remove the internal directive to allow URIs like this
    internal;
  }

  location ~ \.php$ {
    return 404;
  }

  error_log /var/log/nginx/project_ssl_error.log;
  access_log /var/log/nginx/project_ssl_access.log;

  ssl_certificate /etc/letsencrypt/live/dev-api******.com/fullchain.pem; # managed by Certbot
  ssl_certificate_key /etc/letsencrypt/live/dev-api******.com/privkey.pem; # managed by Certbot
}