XMLHttpRequest请求的资源上不存在“ Access-Control-Allow-Origin”标头

在app / controllers / application_controller.rb中：

before_filter :add_allow_credentials_headers

def add_allow_credentials_headers                                                                                                                                                                                                                                                        
  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#section_5                                                                                                                                                                                                      
  #                                                                                                                                                                                                                                                                                       
  # Because we want our front-end to send cookies to allow the API to be authenticated                                                                                                                                                                                                   
  # (using 'withCredentials' in the XMLHttpRequest), we need to add some headers so                                                                                                                                                                                                      
  # the browser will not reject the response                                                                                                                                                                                                                                             
  response.headers['Access-Control-Allow-Origin'] = request.headers['Origin'] || '*'                                                                                                                                                                                                     
  response.headers['Access-Control-Allow-Credentials'] = 'true'                                                                                                                                                                                                                          
end 

def options                                                                                                                                                                                                                                                                              
  head :status => 200, :'Access-Control-Allow-Headers' => 'accept, content-type'                                                                                                                                                                                                         
end

在config / routes.rb中：

match '*any' => 'application#options', :via => [:options]

注意，这是对Angular前端执行POST请求时需要的OPTIONS请求的响应。我对Access-Control-Allow-Credentials所做的工作是针对我的应用程序的，因此cookie是从前端发送的。

我强烈建议您阅读上面我的代码中该mozilla链接中的文档。它对CORS有非常详尽的解释。您可能会发现上面的代码对您的目的而言太宽松了。