// 设置允许访问的域名
Access-Control-Allow-Origin: http://172.20.0.206
// 通用配置（通配符、指定域名、动态设置）
// 是否允许携带认证信息（cookies），该值只能是true
Access-Control-Allow-Credentials: true
// 预检请求缓存时间
Access-Control-Max-Age: 1800
// 允许的请求方法
Access-Control-Allow-Methods: GET, POST, PUT
// 允许的请求头字段
Access-Control-Allow-Headers: x-requested-with, content-type

Nginx配置方案

# 域名匹配规则
if ($http_origin ~* "^(.*?)\.domain\.com$") {
    set $cors_origin $http_origin;
}

# 预检请求处理
if ($request_method = 'OPTIONS') {
    add_header Access-Control-Allow-Methods GET,POST,OPTIONS;
    add_header Access-Control-Allow-Origin $cors_origin;
    add_header Access-Control-Allow-Credentials true;
    add_header Access-Control-Allow-Headers 'Content-Type,X-Requested-With';
    return 204;
}

PHP实现方式

if (!empty($_SERVER["HTTP_ORIGIN"]) && preg_match('/\.domain\.com$/', $_SERVER["HTTP_ORIGIN"])) {
    header('Access-Control-Allow-Origin: ' . $_SERVER["HTTP_ORIGIN"]);
    header('Access-Control-Allow-Credentials: true');
}
header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Origin, X-Requested-With');

Axios配置说明

// 当使用通配符配置时需禁用Cookie携带
axios.defaults.withCredentials = true
// 后端需配合设置Access-Control-Allow-Credentials: true
// 通配符配置时需将此参数设为false

ThinkPHP6中间件实现

namespace app\api\middleware;

use Closure;
use think\Config;
use think\Response;

class CorsConfigMiddleware
{
    protected $headers = [
        'Access-Control-Allow-Origin' => 'test.domain.com',
        'Access-Control-Max-Age' => 86400,
        'Access-Control-Allow-Methods' => 'GET,POST,OPTIONS',
        'Access-Control-Allow-Headers' => 'Authorization, Content-Type, Origin'
    ];

    public function handle($request, Closure $next)
    {
        $origin = $request->header('origin');
        $headers = $this->headers;
        
        if ($origin) {
            $headers['Access-Control-Allow-Origin'] = $origin;
        } else {
            $headers['Access-Control-Allow-Origin'] = '*';
        }

        return $next($request)->header($headers);
    }
}

中间件引用配置

return [
    app\api\middleware\CorsConfigMiddleware::class
];