API在其他域正常运行，子域调用报CORS错误求助

问题描述 #

调用API时出现如下CORS错误：

Access to XMLHttpRequest at ... has been blocked by CORS policy: Request header field content-type is not allowed by Access-Control-Allow-Headers in preflight response.

API在其他域可正常运行，但子域调用时报错，已添加部分CORS响应头但无效，当前request.php代码如下：

header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, post, get');
header('Content-type: application/json');

$data = [ 'msisdn' => '1111', 'result' => 'success', 'message' => 'hi'  ];

echo $a=json_encode( $data ); 

解决方案 #

错误核心是预检请求（OPTIONS）的响应头缺少Access-Control-Allow-Headers字段，未允许content-type请求头，同时需要正确处理OPTIONS请求：

修改request.php代码如下：

// 处理OPTIONS预检请求
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    header('Access-Control-Allow-Origin: *');
    header('Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS');
    header('Access-Control-Allow-Headers: Content-Type');
    // 直接返回204状态码结束请求
    http_response_code(204);
    exit;
}

// 正常请求的CORS头
header('Access-Control-Allow-Origin: *');
header('Content-type: application/json');

$data = [ 'msisdn' => '1111', 'result' => 'success', 'message' => 'hi'  ];
echo json_encode($data); 

关键修改点 #

• 单独处理OPTIONS请求：浏览器发起跨域POST/PUT等带自定义头的请求时，会先发送OPTIONS预检请求，需直接返回响应头并结束请求
• 添加Access-Control-Allow-Headers: Content-Type：明确允许请求中的content-type头，匹配错误提示要求
• 精简Access-Control-Allow-Methods：移除重复的post/get，保持格式规范

内容的提问来源于stack exchange，提问作者Jay Doshi