Django 跨域资源共享(CORS)全面配置指南

pip install django-cors-headers  # 当前版本4.3.1

# settings.py
MIDDLEWARE = [
    'corsheaders.middleware.CorsMiddleware',  # 必须尽可能靠前
    'django.middleware.common.CommonMiddleware',
    # 其他中间件...
]

# 允许的域名白名单
CORS_ALLOWED_ORIGINS = [
    "https://www.example.com",
    "http://localhost:8080",
]
# 启用带凭证的请求
CORS_ALLOW_CREDENTIALS = True
CSRF_COOKIE_SAMESITE = 'None'  # 配合CORS使用
SESSION_COOKIE_SAMESITE = 'None'

# 允许的HTTP方法
CORS_ALLOW_METHODS = [
    'GET',
    'POST',
    'PUT',
    'PATCH',
    'DELETE',
    'OPTIONS'
]
# 允许的自定义Headers
CORS_ALLOW_HEADERS = [
    'accept',
    'accept-encoding',
    'authorization',
    'content-type',
    'dnt',
    'origin',
    'user-agent',
    'x-csrftoken',
    'x-requested-with',
]
# 预检请求缓存时间(秒)
CORS_PREFLIGHT_MAX_AGE = 86400  # 24小时

# 结合数据库动态控制
def cors_allow_origins(request):
    allowed_domains = Site.objects.filter(is_active=True).values_list('domain', flat=True)
    return [f"https://{domain}" for domain in allowed_domains]

CORS_ALLOWED_ORIGINS = cors_allow_origins(None)

# 开发环境配置
if DEBUG:
    CORS_ALLOW_ALL_ORIGINS = True
    CORS_ALLOW_HEADERS += ['debug-token']
else:
    CORS_ALLOWED_ORIGIN_REGEXES = [
        r"^https://\w+\.example\.com$",
        r"^https://example-\d+-app\.cloudprovider\.com$"
    ]

# 添加自定义CORS头
CORS_EXPOSE_HEADERS = ['X-Custom-Header', 'Content-Range']

# 在中间件中动态添加
class CustomCorsMiddleware(CorsMiddleware):
    def process_response(self, request, response):
        response = super().process_response(request, response)
        response['X-API-Version'] = '2.0'
        return response

CORS_ALLOW_CREDENTIALS = True
CORS_ALLOWED_ORIGINS = [
    "https://www.example.com",
    "https://cdn.example.net"
]
CORS_ALLOW_METHODS = ['GET', 'POST', 'OPTIONS']
CORS_ALLOW_HEADERS = [
    'authorization',
    'content-type',
]
CORS_PREFLIGHT_MAX_AGE = 600  # 10分钟

# 限制OPTIONS请求频率
from django.core.cache import cache

class ThrottledCorsMiddleware(CorsMiddleware):
    def process_view(self, request, *args, **kwargs):
        if request.method == 'OPTIONS':
            ip = request.META.get('REMOTE_ADDR')
            if cache.get(f'cors_options_{ip}'):
                return HttpResponseTooManyRequests()
            cache.set(f'cors_options_{ip}', True, 60)
        return super().process_view(request, *args, **kwargs)

# 使用cURL验证
curl -H "Origin: http://test.com" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: X-Requested-With" \
  -X OPTIONS --verbose http://api.example.com/data

// 前端测试代码
fetch('https://api.example.com/data', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  credentials: 'include'
}).then(response => {
  console.log(response.headers.get('Access-Control-Allow-Origin'))
});