Openfire Rest API插件HTTPS访问报错：Authorization头跨域问题求助

Hey there, let's break down why you're hitting this CORS error when accessing the Openfire Rest API. The error message spells it out clearly: your browser's preflight OPTIONS request got a response that doesn't include Authorization in the Access-Control-Allow-Headers list, so it blocks the actual request from going through. Here are the most likely fixes to try:

1. Correct Your API Request Path #

First off, your request URL has an extra, unnecessary segment: /http-bind. The Openfire Rest API lives directly under the plugins path, not nested inside the BOSH (http-bind) endpoint (which is for XMPP web clients).

Your current URL:
https://my-openfire.org.ua:7443/http-bind/plugins/restapi/v1/chatrooms

The correct URL should be:
https://my-openfire.org.ua:7443/plugins/restapi/v1/chatrooms

Using the wrong path means you're not hitting the Rest API's endpoint at all—you're probably talking to the BOSH service, which doesn't have the CORS configuration needed for the Rest API. That's a super common mix-up!

2. Update the Rest API Plugin's CORS Settings #

Once you're using the correct path, make sure the Rest API plugin is configured to allow the Authorization header in cross-origin requests:

• Log into your Openfire admin console (usually at https://my-openfire.org.ua:9091)
• Navigate to Plugins > REST API
• Look for the CORS configuration section (labeled "Cross-Origin Resource Sharing" in most versions)
• Find the Allowed Headers field and add Authorization to the list (separate from existing headers with commas if needed)
• Save the settings and restart the plugin (or Openfire entirely if the plugin requires it)

3. Check Openfire's Global HTTP CORS Config #

Sometimes Openfire's global HTTP service settings can override plugin-specific CORS rules:

• Go to Server > Server Settings > HTTP Binding (or HTTP Services, depending on your Openfire version)
• Look for CORS-related options in this section
• If there's an "Allowed Headers" field here, make sure Authorization is included too

4. Verify with a Manual Preflight Request #

To confirm your changes work, send an OPTIONS request via curl to check the response headers:

curl -X OPTIONS -H "Access-Control-Request-Headers: Authorization" https://my-openfire.org.ua:7443/plugins/restapi/v1/chatrooms

Look for the Access-Control-Allow-Headers response header—if it includes Authorization, your configuration is correct.

In most cases, fixing the request path and updating the CORS allowed headers will resolve this error. Give these steps a shot!

内容的提问来源于stack exchange，提问作者Volodymyr Shevchuk