<?php
 
// 中間件配置
 
use think\middleware\AllowCrossDomain;
 
return [
    AllowCrossDomain::class
];
 

Access to XMLHttpRequest at from origin has been blocked by CORS policy: 
Request header field x-token is not allowed by 
Access-Control-Allow-Headers in preflight response.

<?php
 
namespace app\middleware;
use think\middleware\AllowCrossDomain;
 
 
class AllowCrossDomainMiddleware extends AllowCrossDomain
{
    // 加入自定義請(qǐng)求頭參數(shù) X-Token
    protected $header = [
        'Access-Control-Allow-Credentials' => 'true',
        'Access-Control-Max-Age'           => 1800,
        'Access-Control-Allow-Methods'     => 'GET, POST, PATCH, PUT, DELETE, OPTIONS',
        'Access-Control-Allow-Headers'     => 'Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With, X-Token',
    ];
}

<?php
 
// 中間件配置
 
use think\middleware\AllowCrossDomain;
use app\middleware\AllowCrossDomainMiddleware;
 
return [
    // 不使用默認(rèn)的跨域中間件
    // AllowCrossDomain::class
 
    // 使用自定義跨域中間件
    AllowCrossDomainMiddleware::class
];
 

// 添加允許跨域請(qǐng)求頭
header("'Access-Control-Allow-Credentials: true");
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With, X-Token");
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS, PATCH');
 
// 處理 OPTIONS 請(qǐng)求
if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
    exit;
}