Outlook插件通过Exchange On-Premises的EWS发邮件遇连接认证问题

问题背景 #

我正在开发Outlook插件，目标是通过Exchange Web Services (EWS)对接Exchange On-Premises环境，向指定Exchange账户发送钓鱼测试邮件。但在前端发起POST请求到EWS端点时，持续遇到连接超时和fetch请求失败的问题。

已尝试操作 #

• EWS端点地址：https://exchange.example.com/ews/Exchange.asmx
• 认证方式：使用用户名+密码的Basic认证，请求体为XML格式
• 触发的错误：React应用抛出ConnectTimeoutError，同时提示fetch请求失败

代码实现 #

const sendEmail = async () => {
  const EXCHANGE_URL = "https://exchange.example.com/ews/Exchange.asmx";
  const USERNAME = "user@example.com";
  const PASSWORD = "password";

  const xmlPayload = `<?xml version="1.0" encoding="utf-8"?>
    <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
      <soap:Header>
        <t:RequestServerVersion Version="Exchange2016" />
      </soap:Header>
      <soap:Body>
        <m:CreateItem xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
          <m:Items>
            <t:Message>
              <t:Subject>Test Email</t:Subject>
              <t:Body BodyType="Text">This is a test email sent via EWS from React frontend.</t:Body>
              <t:ToRecipients>
                <t:Mailbox>
                  <t:EmailAddress>recipient@example.com</t:EmailAddress>
                </t:Mailbox>
              </t:ToRecipients>
            </t:Message>
          </m:Items>
        </m:CreateItem>
      </soap:Body>
    </soap:Envelope>`;

  try {
    const response = await fetch(EXCHANGE_URL, {
      method: "POST",
      headers: {
        "Content-Type": "text/xml",
        "Authorization": "Basic " + btoa(`${USERNAME}:${PASSWORD}`)
      },
      body: xmlPayload,
    });

    const data = await response.text();
    console.log("Email sent successfully:", data);
  } catch (error) {
    console.error("Error connecting to Exchange:", error);
  }
};

sendEmail();

故障排查与解决方案 #

1. 跨域限制（CORS） #

前端直接调用EWS端点会触发浏览器跨域拦截，Exchange On-Premises默认不会配置允许前端域名的CORS规则。

• 解决：改用后端代理。在后端服务中封装EWS请求，前端调用自有后端接口，由后端转发请求至EWS，规避跨域问题。

2. 网络连通性问题 #

• 验证前端（或后端代理）与Exchange服务器的网络连通：使用telnet exchange.example.com 443或curl https://exchange.example.com/ews/Exchange.asmx测试端口是否开放、端点是否可达。
• 检查Exchange服务器防火墙：确保允许请求来源IP访问EWS端点的443端口。

3. Basic认证配置问题 #

• 确认用户名格式：Exchange On-Premises可能要求使用DOMAIN\username格式而非邮箱地址，尝试替换USERNAME为域账号格式。
• 检查编码正确性：若密码含特殊字符，手动生成Base64编码的用户名:密码字符串替换到Authorization头中测试，避免btoa编码异常。
• 确认EWS认证设置：在Exchange管理控制台中检查EWS虚拟目录是否启用Basic认证。

4. 请求格式补全 #

EWS要求POST请求携带SOAPAction头，当前代码缺少该字段，需添加至请求头：

headers: {
  "Content-Type": "text/xml",
  "Authorization": "Basic " + btoa(`${USERNAME}:${PASSWORD}`),
  "SOAPAction": "http://schemas.microsoft.com/exchange/services/2006/messages/CreateItem"
}

内容的提问来源于stack exchange，提问作者Shahzad Umar