求助：CORS请求重定向被浏览器拦截问题排查

请求流程 #

Browser ---> K8 NGINX Ingress Controller ---> Service 
                                   |
                                   |
                               Oauth Proxy 

Chrome开发者工具捕获信息 #

预检请求（Preflight） #

General:
Request URL: https://yyyy
Request Method: OPTIONS
Status Code: 204
Remote Address: x.x.x.x:443
Referrer Policy: strict-origin-when-cross-origin

预检请求头 #

:authority: yyyy
:method: OPTIONS
:path: /api
:scheme: https
accept:*/* 
accept-encoding: gzip, deflate, br 
accept-language: en-US,en;q=0.9 
access-control-request-headers: x-requested-with
access-control-request-method: GET 
cache-control: no-cache 
origin: https://xxxx 
pragma: no-cache 
referer: https://xxxx 
sec-fetch-dest: empty 
sec-fetch-mode: cors 
sec-fetch-site: same-site 
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36

预检响应头 #

access-control-allow-credentials: true 
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization 
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS 
access-control-allow-origin: https://xxx 
access-control-max-age: 1728000 
content-length: 0 
date: Mon, 06 Feb 2023 13:47:36 GMT strict-transport-security: max-age=15724800; includeSubDomains

原始请求 #

请求头

:authority: yyyy
:method: GET 
:path: /api 
:scheme: https 
accept: */* 
accept-encoding: gzip, deflate, br 
accept-language: en-US,en;q=0.9 
cache-control: no-cache origin: https://xxxx 
pragma: no-cache 
referer: https://xxxx 
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108", "Google Chrome";v="108" 
sec-ch-ua-mobile: ?0 
sec-ch-ua-platform: "Windows" 
sec-fetch-dest: empty 
sec-fetch-mode: cors 
sec-fetch-site: same-site 
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 x-requested-with: XMLHttpRequest

请求概况

Request URL: https://yyy/a/api/a/a?=abc
Request Method: GET
Status Code: 302  
Referrer Policy: strict-origin-when-cross-origin

原始请求响应头 #

content-length: 138  
content-type: text/html 
date: Mon, 06 Feb 2023 13:47:36 GMT 
location: https://yyyy/oauth2/start?rd=%2Fa%2Fapi%2Fs%2Fb%3Fx%3D1

浏览器拦截提示 #

Access to XMLHttpRequest at 'https://yyyy from origin 'https://xxxx has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource

已采取的排查步骤 #

• 查阅Stack Overflow相关问题，包括《Chrome cancels CORS XHR upon HTTP 302 redirect》
• 阅读CORS教程文档及Mozilla官方CORS相关说明
• 学习Medium上的CORS实战教程系列

问题仍未解决，恳请技术支持。

内容的提问来源于stack exchange，提问作者thegrind