I'm doing an AJAX call from domain A to domain B.
My domain B checks if A is in the list of allowed domains and sets the Access-Control-allow-Origin
to domain A. So far, so good.
Domain B responds to the request by sending a 302 redirect to domain C using the Location
header.
The AJAX call follows the redirect to domain C but has the header: Origin: null
.
I expected the origin
header to be set to domain A, after following the redirect.
Can anyone explain to me why the origin is set to null
instead of to domain A?
Example
Request from domain A to B
GET / HTTP/1.1
Host: domain-B.com
Origin: http://domain-A.com
Response from domain B :
Access-Control-Allow-Origin: http://domain-A.com
Location: http://domain-C.com
AJAX call follows the redirect to domain C:
GET HTTP/ 1.1
Host: domain-C.com
Origin: null
See Question&Answers more detail:
os 与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…