使用LinkedIn Share API v2前端发布失败，CORS问题及后端调用方案咨询

Why Your Frontend Call Isn't Working #

• LinkedIn's v2 API doesn't support direct frontend/browser requests—their server enforces strict CORS policies that block cross-origin calls from client-side code, even with CORS plugins like Moesif. These plugins only work for testing local environments and won't bypass LinkedIn's production-level restrictions.
• Exposing your OAuth access token in frontend code is a critical security risk: anyone inspecting your page can steal it and perform actions on your LinkedIn account without permission.

Correct Approach: Call LinkedIn API from Your Backend #

You need to create a backend endpoint that acts as a secure middleman. Your frontend will send requests to your own backend, and your backend will handle the authenticated call to LinkedIn's API. This fixes the CORS issue and keeps your access token safe.

Step 1: Backend Code Example (Node.js/Express) #

Here's a straightforward implementation using Node.js and Express (adapt this to your preferred backend stack):

const express = require('express');
const axios = require('axios');
const app = express();
app.use(express.json());

// CORS setup for your frontend (adjust the origin to match your app's URL)
app.use((req, res, next) => {
  res.header('Access-Control-Allow-Origin', 'http://your-frontend-url.com');
  res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
  res.header('Access-Control-Allow-Methods', 'POST');
  next();
});

// Backend endpoint to handle LinkedIn share requests
app.post('/api/linkedin/share', async (req, res) => {
  const { token, shareBody } = req.body;
  
  try {
    const linkedInResponse = await axios.post(
      'https://api.linkedin.com/v2/shares',
      shareBody,
      {
        headers: {
          'Content-Type': 'application/json',
          'Authorization': `Bearer ${token}`,
          'cache-control': 'no-cache',
          'X-Restli-Protocol-Version': '2.0.0'
        }
      }
    );
    res.status(linkedInResponse.status).json(linkedInResponse.data);
  } catch (error) {
    console.error('LinkedIn API Error:', error.response?.data || error.message);
    res.status(error.response?.status || 500).json(
      error.response?.data || { message: 'Failed to share content on LinkedIn' }
    );
  }
});

app.listen(3000, () => console.log('Backend server running on port 3000'));

Step 2: Update Your Frontend Code #

Modify your frontend to call your backend endpoint instead of LinkedIn's API directly:

publishPostLink(body : any, token : any){
  // Send token and share body to your backend
  return this.http.post("http://your-backend-url.com/api/linkedin/share", 
    { token: token, shareBody: body }, 
    { headers: new HttpHeaders({ 'Content-Type': 'application/json' }) }
  );
}

Quick Validation for Your Share Body #

Your request body looks valid for LinkedIn's v2 Shares API, but double-check one key detail:

• Confirm the owner URN (urn:li:person:XXXXXX) matches the authenticated user's person URN. You can fetch this URN using LinkedIn's Me API if you don't have it stored.

内容的提问来源于stack exchange，提问作者Amira Messoud