CORS POST 请求可以使用纯 JavaScript，但为什么不使用 jQuery

更新:正如TimK指出的，jQuery1.5.2不再需要这种功能.但是，如果您想添加自定义标题或允许使用凭据(用户名、密码或cookie等)，请继续阅读.

I think I found the answer! (4 hours and a lot of cursing later)

//This does not work!!
Access-Control-Allow-Headers: *

您需要手动指定将接受的所有标题(至少在FF 4.0和Chrome 10.0.648.204中是这样).

jQuery的美元.ajax方法为所有跨域请求发送"x-request-with"头(我认为它是唯一的跨域请求).

So the missing header needed to respond to the OPTIONS request is:

//no longer needed as of jquery 1.5.2
Access-Control-Allow-Headers: x-requested-with

如果您正在传递任何非"简单"的标头，则需要将它们包括在您的列表中(我再发送一个):

//only need part of this for my custom header
Access-Control-Allow-Headers: x-requested-with, x-requested-by

So to put it all together, here is my PHP:

// * wont work in FF w/ Allow-Credentials
//if you dont need Allow-Credentials, * seems to work
header('Access-Control-Allow-Origin: http://www.example.com');
//if you need cookies or login etc
header('Access-Control-Allow-Credentials: true');
if ($this->getRequestMethod() == 'OPTIONS')
{
  header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
  header('Access-Control-Max-Age: 604800');
  //if you need special headers
  header('Access-Control-Allow-Headers: x-requested-with');
  exit(0);
}