CORS配置疑问：curl命令报错及全局开启CORS求助

问题背景 #

网站存在CORS拦截问题，已在PHP中配置Access-Control-Allow-Origin: *等跨域响应头，同时在.htaccess文件中设置了特定域名的CORS规则、OPTIONS请求200响应跳转及HTTPS强制跳转，但执行curl OPTIONS测试时出现“Could not resolve host”错误，仍有用户反馈fetch请求因CORS拦截无法正常获取内容。

现有配置 #

PHP代码 #

<?php
    session_start();
    header('Access-Control-Allow-Origin: *');
    header("Access-Control-Allow-Methods: HEAD, GET, POST, PUT, PATCH, DELETE, OPTIONS");
    header("Access-Control-Allow-Headers: X-API-KEY, Origin, X-Requested-With, Content-Type, 
    Accept, Access-Control-Request-Method,Access-Control-Request-Headers, Authorization");

.htaccess配置 #

# Enable cross domain access control
SetEnvIf Origin "^http(s)?://(.+\.)?(mietkauf-pkw\.de)$" REQUEST_ORIGIN=$0
Header always set Access-Control-Allow-Origin %{REQUEST_ORIGIN}e env=REQUEST_ORIGIN
Header always set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
Header always set Access-Control-Allow-Headers "x-test-header, Origin, X-Requested-With, Content-Type, Accept"
Header set Access-Control-Allow-Credentials true

# Force to request 200 for options
RewriteEngine On
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule .* / [R=200,L]

RewriteEngine On
RewriteCond %{SERVER_PORT} !=443
RewriteRule ^(.*)$ https://mietkauf-pkw.de/$1 [R=301,L]

测试curl命令及报错信息 #

测试命令：

curl -H "Origin: https://mietkauf-pkw.de" \ -H 'Access-Control-Request-Method: POST' \ -H "Access-Control-Request-Headers: X-Requested-With" \ -X OPTIONS --verbose \ "https://mietkauf-pkw.de/pages/login.php"

报错输出：

* Could not resolve host: \
* Closing connection 0
curl: (6) Could not resolve host: \
* Could not resolve host: POST'
* Closing connection 1
curl: (6) Could not resolve host: POST'
* Could not resolve host: \
* Closing connection 2
curl: (6) Could not resolve host: \
* Could not resolve host: \
* Closing connection 3
curl: (6) Could not resolve host: \
* Could not resolve host: \
* Closing connection 4

*   Trying 2001:8d8:100f:f000::200:443...
* Connected to mietkauf-pkw.de (2001:8d8:100f:f000::200) port 443 (#5)
* schannel: disabled automatic use of client certificate
* ALPN: offers http/1.1
* ALPN: server accepted http/1.1
> OPTIONS /pages/login.php HTTP/1.1
> Host: mietkauf-pkw.de
> User-Agent: curl/7.83.1
> Accept: */*
> Origin: https://mietkauf-pkw.de
> Access-Control-Request-Headers: X-Requested-With
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Content-Type: text/html; charset=iso-8859-1
< Content-Length: 476
< Connection: keep-alive
< Keep-Alive: timeout=15
< Date: Sun, 19 Mar 2023 17:36:35 GMT
< Server: Apache
< Access-Control-Allow-Origin: https://mietkauf-pkw.de
< Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
< Access-Control-Allow-Headers: x-test-header, Origin, X-Requested-With, Content-Type, Accept
<

问题排查与解决方案 #

1. curl命令错误修复 #

报错中的“Could not resolve host: \”是因为命令里的换行反斜杠后存在空格，导致curl将反斜杠和空格误识别为主机名。修正后的命令：

curl -H "Origin: https://mietkauf-pkw.de" \
-H 'Access-Control-Request-Method: POST' \
-H "Access-Control-Request-Headers: X-Requested-With" \
-X OPTIONS --verbose "https://mietkauf-pkw.de/pages/login.php"

注意反斜杠后直接换行，不要添加空格。

2. 核心冲突：PHP与.htaccess的CORS规则矛盾 #

• PHP设置了Access-Control-Allow-Origin: *，但.htaccess仅允许mietkauf-pkw.de域名，两者规则冲突，服务器实际返回的是.htaccess定义的头。
• Access-Control-Allow-Credentials: true与Origin: *不兼容，浏览器会直接拦截同时包含这两个头的响应，这是用户反馈CORS拦截的主要原因。

3. 全局CORS配置实现 #

要开启全局CORS，需统一配置规则，推荐用.htaccess统一管理（避免PHP和.htaccess重复设置）：

修正后的.htaccess配置

# 优先强制HTTPS跳转
RewriteEngine On
RewriteCond %{SERVER_PORT} !=443
RewriteRule ^(.*)$ https://mietkauf-pkw.de/$1 [R=301,L]

# 全局CORS配置
# 允许所有来源，如需限制特定域名，修改SetEnvIf正则即可
SetEnvIf Origin "^http(s)?://(.+)$" REQUEST_ORIGIN=$0
Header always set Access-Control-Allow-Origin %{REQUEST_ORIGIN}e env=REQUEST_ORIGIN

# 若无需携带跨域凭证，注释下一行；若需要，Origin不能设为*，需指定具体域名
# Header set Access-Control-Allow-Credentials true

# 允许所有HTTP方法，覆盖原有规则
Header always set Access-Control-Allow-Methods "HEAD, GET, POST, PUT, PATCH, DELETE, OPTIONS"

# 允许所有必要请求头，与PHP配置对齐
Header always set Access-Control-Allow-Headers "X-API-KEY, Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization"

# 处理OPTIONS预检请求，直接返回200，无需跳转至根目录
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule .* - [R=200,L]

PHP代码调整

删除PHP中的CORS相关头设置，避免冲突：

<?php
    session_start();
    // 移除所有CORS响应头配置

4. 验证方法 #

1. 使用修正后的curl命令测试OPTIONS请求，确认响应头包含与请求Origin匹配的Access-Control-Allow-Origin。
2. 在前端发起跨域fetch请求，检查浏览器控制台是否存在CORS错误。
3. 若需支持带凭证的请求，确保Access-Control-Allow-Credentials: true且Origin指定具体域名，同时前端fetch需设置credentials: 'include'。

内容的提问来源于stack exchange，提问作者newexe91