Summary of a cross-origin upload crawling experience from Ueditor

One of the project's management backend needs to publish an article and a rich text editor. After some selection, Baidu's Ueditor is selected.

Because the uploaded files are uploaded to another server that stores images and other static resources, cross-origin upload is involved.

The main method for implementing cross-origin upload is to separate the front and back ends of the editor, put the front ends directly in the desired project, and put the backend (with permission verification) that receives the upload on the image server.

You need to add two HTTP headers for cross-origin:

Access-Control-Allow-Origin: * // allows cross-Origin requests initiated by any domain name

Access-Control-Allow-Headers: X-Requested-With,X_Requested_With

The development machine uses WIN7, and IIS7 performs cross-origin uploads on the development machine. Then, it performs debugging on IIS6.

When the project runs on iis6.

The first error is 403.1.

The backend processing code is the "General handler" ashx. By default, IIS6 does not accept the OPTIONS request. Therefore, you must add the allowed OPTIONS request for ashx.

After everything was ready, the tragedy happened again.

This time, the 500 error was introduced.

After one day of data query, no solution was found. Finally, a trace of CORS was found on Firefox.

The CORS specification is used for HTML5 uploads. That is, an OPTIONS request is sent to the server before a real upload request is sent. In this case, the server must respond to the HTTP header that allows cross-origin uploads, then interrupt the output. After the browser receives an HTTP header that allows cross-origin upload, it will initiate a real file upload request (POST) again ).

According to the CORS specification, the OPTIONS response is performed on the back-end code, and the output can be interrupted.

The text expression capability is not very good. Sorry.