Windows Service托管WCF RESTful后遭遇CORS错误求助

1. 校验App.config配置的正确性 #

确保自定义CORS头配置在对应绑定的节点下，且关联到正确的服务端点。示例正确配置如下：

<system.serviceModel>
  <bindings>
    <webHttpBinding>
      <binding name="CrossDomainBinding">
        <customHeaders>
          <add name="Access-Control-Allow-Origin" value="http://localhost:3000" />
          <add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, OPTIONS" />
          <add name="Access-Control-Allow-Headers" value="Content-Type" />
        </customHeaders>
      </binding>
    </webHttpBinding>
  </bindings>
  <services>
    <service name="RestWCFServiceLibrary.YourServiceImpl">
      <endpoint 
        address="json" 
        binding="webHttpBinding" 
        bindingConfiguration="CrossDomainBinding" 
        contract="RestWCFServiceLibrary.IYourService"
        behaviorConfiguration="WebHttpBehavior" />
    </service>
  </services>
  <behaviors>
    <endpointBehaviors>
      <behavior name="WebHttpBehavior">
        <webHttp />
      </behavior>
    </endpointBehaviors>
  </behaviors>
</system.serviceModel>

• 替换YourServiceImpl和IYourService为实际的服务实现类与接口名
• 确认端点address与请求路径/RestWCFServiceLibrary/json匹配

2. 处理OPTIONS预检请求 #

浏览器发送复杂跨域请求时会先发起OPTIONS预检，WCF默认不处理该请求，导致头无法返回。两种解决方式：

方式一：在服务中声明OPTIONS操作 #

在服务接口添加：

[OperationContract]
[WebInvoke(Method = "OPTIONS", UriTemplate = "*")]
void HandleOptionsRequest();

服务实现类中添加空实现：

public void HandleOptionsRequest()
{
    // 无需业务逻辑，仅让WCF返回200响应
}

方式二：自定义消息拦截器 #

创建实现IDispatchMessageInspector的拦截器，强制添加CORS头并处理OPTIONS请求：

public class CorsInterceptor : IDispatchMessageInspector
{
    public object AfterReceiveRequest(ref Message request, IClientChannel channel, InstanceContext instanceContext)
    {
        if (request.Properties.TryGetValue("HttpMethod", out var methodObj) && 
            methodObj.ToString().Equals("OPTIONS", StringComparison.OrdinalIgnoreCase))
        {
            // 标记OPTIONS请求，后续返回空响应
            return "options-handled";
        }
        return null;
    }

    public void BeforeSendReply(ref Message reply, object correlationState)
    {
        var responseProp = reply.Properties.ContainsKey(HttpResponseMessageProperty.Name)
            ? (HttpResponseMessageProperty)reply.Properties[HttpResponseMessageProperty.Name]
            : new HttpResponseMessageProperty();

        // 添加CORS头
        responseProp.Headers.Add("Access-Control-Allow-Origin", "http://localhost:3000");
        responseProp.Headers.Add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
        responseProp.Headers.Add("Access-Control-Allow-Headers", "Content-Type");

        if (correlationState?.ToString() == "options-handled")
        {
            // OPTIONS请求返回200状态码
            responseProp.StatusCode = HttpStatusCode.OK;
            reply = Message.CreateMessage(MessageVersion.None, string.Empty);
        }

        reply.Properties[HttpResponseMessageProperty.Name] = responseProp;
    }
}

随后将拦截器添加到端点行为中（可通过配置或代码实现）。

3. 验证服务运行环境 #

• 确保Windows Service有权限监听http://localhost:8888，可通过netsh命令注册URL：

  netsh http add urlacl url=http://+:8888/ user=NT AUTHORITY\LocalService
  

  （根据服务实际运行账户调整user参数）
• 确认服务已正常启动，直接访问http://localhost:8888/RestWCFServiceLibrary/json验证服务是否可正常响应。

4. 排查外部干扰 #

• 用浏览器开发者工具或Fiddler查看实际响应头，确认是否真的未返回CORS头
• 排除代理、防火墙等中间件修改或过滤响应头的可能

内容的提问来源于stack exchange，提问作者Wan Aideed