跨域与 CORS：浏览器的边境管制

python3 -c '
from http.server import BaseHTTPRequestHandler, HTTPServer
 
ALLOWED = {"http://app.example.com", "http://localhost:3000"}
 
class H(BaseHTTPRequestHandler):
    def do_GET(self):
        origin = self.headers.get("Origin", "")
        body = b"{\"data\": \"secret numbers\"}"
        self.send_response(200)
        if origin in ALLOWED:
            self.send_header("Access-Control-Allow-Origin", origin)
            self.send_header("Vary", "Origin")   # 按 Origin 回显时必须加
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)
    def log_message(self, *a):
        pass
 
HTTPServer(("127.0.0.1", 8000), H).serve_forever()
' &
for _i in $(seq 1 50); do (exec 3<>/dev/tcp/127.0.0.1/8000) 2>/dev/null && break; sleep 0.1; done
 
echo "== 白名单内的 Origin：响应带上了许可头 =="
curl -si http://127.0.0.1:8000/api -H "Origin: http://app.example.com" \
  | grep -iE "HTTP/|access-control|vary|data"
 
echo "== 陌生 Origin：注意！响应体照样返回了 =="
curl -si http://127.0.0.1:8000/api -H "Origin: http://evil.com" \
  | grep -iE "HTTP/|access-control|data"

① 预检   OPTIONS /api/users
         Origin: http://app.example.com
         Access-Control-Request-Method: PUT          我想用 PUT
         Access-Control-Request-Headers: x-token     我想带这个头
 
② 放行   204 No Content
         Access-Control-Allow-Origin: http://app.example.com
         Access-Control-Allow-Methods: GET, PUT, DELETE
         Access-Control-Allow-Headers: x-token
         Access-Control-Max-Age: 600                 十分钟内免预检
 
③ 真实请求  PUT /api/users （带 x-token）

python3 -c '
from http.server import BaseHTTPRequestHandler, HTTPServer
 
ORIGIN = "http://app.example.com"
 
class H(BaseHTTPRequestHandler):
    def do_OPTIONS(self):
        self.send_response(204)
        self.send_header("Access-Control-Allow-Origin", ORIGIN)
        self.send_header("Access-Control-Allow-Methods", "GET, PUT, DELETE")
        self.send_header("Access-Control-Allow-Headers", "X-Token, Content-Type")
        self.send_header("Access-Control-Max-Age", "600")
        self.end_headers()
    def do_PUT(self):
        body = b"updated"
        self.send_response(200)
        self.send_header("Access-Control-Allow-Origin", ORIGIN)
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)
    def log_message(self, *a):
        pass
 
HTTPServer(("127.0.0.1", 8000), H).serve_forever()
' &
for _i in $(seq 1 50); do (exec 3<>/dev/tcp/127.0.0.1/8000) 2>/dev/null && break; sleep 0.1; done
 
echo "== 第一步：浏览器自动发出的预检 =="
curl -si -X OPTIONS http://127.0.0.1:8000/api/users \
  -H "Origin: http://app.example.com" \
  -H "Access-Control-Request-Method: PUT" \
  -H "Access-Control-Request-Headers: X-Token" | grep -iE "HTTP/|access-control"
 
echo "== 第二步：预检通过后的真实请求 =="
curl -si -X PUT http://127.0.0.1:8000/api/users \
  -H "Origin: http://app.example.com" -H "X-Token: abc" \
  | grep -iE "HTTP/|access-control|updated"

python3 -c '
from http.server import BaseHTTPRequestHandler, HTTPServer
 
class H(BaseHTTPRequestHandler):
    def do_GET(self):
        origin = self.headers.get("Origin", "")
        if self.path == "/good":
            self.send_response(200)
            self.send_header("Access-Control-Allow-Origin", origin)
            self.send_header("Content-Length", "2")
            self.end_headers()
            self.wfile.write(b"ok")
        else:
            # 模拟常见框架行为：异常路径直接抛 500，中间件没来得及加 CORS 头
            self.send_response(500)
            self.send_header("Content-Length", "5")
            self.end_headers()
            self.wfile.write(b"boom\n")
    def log_message(self, *a):
        pass
 
HTTPServer(("127.0.0.1", 8000), H).serve_forever()
' &
for _i in $(seq 1 50); do (exec 3<>/dev/tcp/127.0.0.1/8000) 2>/dev/null && break; sleep 0.1; done
 
echo "== 正常接口：有许可头 =="
curl -si http://127.0.0.1:8000/good -H "Origin: http://a.com" | grep -iE "HTTP/|access-control"
echo "== 报错接口：500 且没有许可头 -> 浏览器只会显示 CORS error =="
curl -si http://127.0.0.1:8000/bad -H "Origin: http://a.com" | grep -iE "HTTP/|access-control"