拒绝在Chrome中获取不安全的标题“Location”，而在firefox中没有内容

Question

我试图将文件上传到ovh对象存储（openstack swift），但遇到了问题。

在Chrome中我得到：

Refused to get unsafe header "Location"

我尝试通过将'Access-Control-Expose-Headers': 'Location'添加到请求标头来解决此问题。但错误仍然存​​在。

在Firefox中，我在控制台中得到以下信息：

OPTIONS XHR
[HTTP/1.1 200 OK 421ms]

Request Headers:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.5
Access-Control-Request-Headers: access-control-expose-headers,tus-resumable,upload-length,upload-metadata,x-auth-token
Access-Control-Request-Method: POST
Connection: keep-alive
Host: storage.gra1.cloud.ovh.net
Origin: http://localhost:8089
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0

Response Headers:
Allow: HEAD, GET, PUT, POST, OPTIONS, DELETE
Content-Length: 0
Date: Thu, 01 Feb 2018 14:55:05 GMT
X-IPLB-Instance: 12318
X-Openstack-Request-Id: txe638462886d66db5ad3c6-005a732a49
X-Trans-Id: txe638462886d66db5ad3c6-005a732a49
access-control-allow-headers: x-auth-token, upload-metadata, upload-length, tus-resumable, access-control-expose-headers
access-control-allow-methods: HEAD, GET, PUT, POST, OPTIONS, DELETE
access-control-allow-origin: *
vary: Access-Control-Request-Headers


POST XHR 
[HTTP/1.1 204 No Content 579ms]
Request Headers
Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.5
Access-Control-Expose-Headers: Location
Connection: keep-alive
Content-Length: 0
Host: storage.gra1.cloud.ovh.net
Origin: http://localhost:8089
Referer: http://localhost:8089/mywebpage
Tus-Resumable: 1.0.0
Upload-Length: 4885581
Upload-Metadata: modelId RmF2b3usrGVz,name MjIyLmpwZz==,type aW1hZ2UvanBlZz==
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0
X-Auth-Token: aSecret000000001

Response Headers
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: x-trans-id, content-language, X-Container-Read, expires, X-Storage-Policy, last-modified, etag, x-timestamp, pragma, cache-control, content-type, x-openstack-request-id
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 01 Feb 2018 14:55:05 GMT
X-IPLB-Instance: 12309
X-Openstack-Request-Id: txe638462886d66db5ad3c6-005a732a49
X-Trans-Id: txe638462886d66db5ad3c6-005a732a49

我不知道'No Content'是否意味着成功，或者出错了，无论如何文件都没有发送，所以可能是最后一个。

我的问题： - 如何摆脱Chrome错误消息 - 如何获取文件。

Answer 1

Access-Control-Expose-Headers应该被请求的资源提供者（OpenStack Swift）添加到响应中，而不是客户端。您需要做的是配置OpenStack Swift以将此标头添加到其响应中。

那你打算怎么做？ OpenStack允许您为每个容器设置/附加Access-Control-Allow-Origin，Access-Control-Max-Age和Access-Control-Expose-Headers的自定义值。有关详细信息，请参阅this official document。

例：

让我们创建一个容器，并设置我们想要添加到Access-Control-Expose-Headers的自定义标头值，以响应对此容器中的对象所做的请求。

curl -i -X PUT -H "X-Auth-Token: yourtoken" \
    -H "X-Container-Meta-Access-Control-Expose-Headers: Location" \
    http://192.168.56.3:8080/v1/AUTH_test/cont1

现在，对于您在此容器中创建的每个对象，您将看到Location中列出的Access-Control-Expose-Headers并删除Chrome中的错误消息。

您可以在我上面链接的文档中看到您可以为每个容器配置的其余CORS标头。