Qt5 QWebEngine自定义URI类型的CORS跨域问题求助

Alright, let's tackle this CORS problem you're facing when redirecting Google's jQuery CDN to your custom conapp:// protocol in QWebEngine. That "Redirect from..." log message is a hint that the browser's security mechanisms are flagging the cross-protocol switch (from https:// to conapp://) as a potential risk. Here's how to resolve this properly:

Why This Happens #

QWebEngine enforces standard web security rules, including CORS (Cross-Origin Resource Sharing). When you redirect a request from a secure HTTPS origin to a custom protocol like conapp://, the browser treats this as a cross-origin request and blocks it unless the custom resource explicitly allows access via CORS headers, or the protocol is marked as trusted.

Step 1: Register Your Custom Protocol with Security Flags #

First, you need to tell QWebEngine that your conapp:// protocol is safe and should be treated as a local, trusted scheme. Do this early in your application's startup (before creating any QWebEngineView instances):

#include <QWebEngineUrlScheme>

// ...

int main(int argc, char *argv[])
{
    QApplication app(argc, argv);

    // Register the custom "conapp" scheme with security flags
    QWebEngineUrlScheme conappScheme("conapp");
    conappScheme.setFlags(
        QWebEngineUrlScheme::SecureScheme |    // Mark as secure (like HTTPS)
        QWebEngineUrlScheme::LocalScheme |     // Treat as local resource
        QWebEngineUrlScheme::LocalAccessAllowed // Allow access from local contexts
    );
    QWebEngineUrlScheme::registerScheme(conappScheme);

    // Rest of your app initialization...
    return app.exec();
}

These flags tell QWebEngine to relax CORS restrictions for conapp:// resources, since they're trusted local resources rather than external cross-origin requests.

Step 2: Add CORS Headers to Your Custom Resource Responses #

If you're using a QWebEngineUrlSchemeHandler to serve the local resources for conapp:// requests, you need to explicitly include CORS headers in the response. This confirms to the browser that the resource allows access from the original page's origin.

Here's an example of how to implement this in your scheme handler:

#include <QWebEngineUrlRequestJob>
#include <QMimeDatabase>

class WebResourceHandler : public QWebEngineUrlSchemeHandler
{
    Q_OBJECT
public:
    void requestStarted(QWebEngineUrlRequestJob *job) override
    {
        // Extract the resource path from the conapp:// URL (e.g., "/webresource/jquery.min.js")
        QString resourcePath = job->requestUrl().path();
        QString localFilePath = findLocalResource(resourcePath); // Your logic to map to local file

        // Load the local file content
        QFile file(localFilePath);
        if (!file.open(QIODevice::ReadOnly)) {
            job->fail(QWebEngineUrlRequestJob::UrlNotFound);
            return;
        }
        QByteArray responseData = file.readAll();

        // Determine the correct MIME type
        QMimeDatabase mimeDb;
        QString mimeType = mimeDb.mimeTypeForFile(localFilePath).name();

        // Add CORS headers to allow cross-origin access
        job->setReplyHeader("Access-Control-Allow-Origin", "*"); // Allow all origins (adjust if needed)
        job->setReplyHeader("Access-Control-Allow-Methods", "GET, HEAD");
        job->setReplyHeader("Access-Control-Allow-Headers", "Content-Type");

        // Send the response
        job->reply(mimeType.toUtf8(), responseData);
    }

private:
    QString findLocalResource(const QString& path) {
        // Your logic to map conapp paths to local file system paths
        return QString("/path/to/your/local/resources%1").arg(path);
    }
};

Step 3: Verify Your Request Interceptor Logic #

Double-check your QWebEngineUrlRequestInterceptor to ensure the redirect is clean and doesn't trigger unnecessary preflight requests. Make sure you're only redirecting GET requests for static resources (like jQuery) since preflight OPTIONS requests aren't always handled correctly with custom protocols:

void RequestInterceptor::interceptRequest(QWebEngineUrlRequestInfo &info)
{
    QString url = info.requestUrl().toString();
    // Check if it's the jQuery CDN URL
    if (url.startsWith("https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js")) {
        // Redirect to your custom protocol
        QUrl redirectUrl("conapp://webresource/jquery.min.js");
        info.redirect(redirectUrl);
    }
}

Last Resort: Disable Web Security (Not Recommended) #

If you're in a testing environment and need a quick fix (though this is unsafe for production), you can disable QWebEngine's web security entirely. This bypasses all CORS checks, but exposes your app to potential security risks:

#include <QWebEngineSettings>

// ...

QWebEngineSettings::defaultSettings()->setAttribute(QWebEngineSettings::WebSecurityEnabled, false);

Only use this as a temporary measure—always prefer the first two steps for production code.

With these changes, QWebEngine should recognize your conapp:// resources as trusted local assets, and the CORS block should be resolved. The redirect log message might still appear, but that's just the browser noting the redirect, not an error anymore.

内容的提问来源于stack exchange，提问作者Berserker