再びクロスドメイン
pip install flask-cors
フラスココアには2つの用途があります。1つはグローバル使用用で、もう1つは指定されたルート用です。
CORS関数を使用してグローバルルーティングを構成しますfrom flask import Flask, request
from flask_cors import CORS
app =Flask(__name__)CORS(app, supports_credentials=True)
その中で、 CORSは、操作をカスタマイズするのに役立ついくつかのパラメーターを提供します。
通常、 origins、 methods、 allow_headers、 supports_credentialsを設定できます
すべての構成項目は次のとおりです。
: param resources:
The series of regular expression and(optionally) associated CORS
options to be applied to the given resource path.
If the argument is a dictionary, it's keys must be regular expressions,
and the values must be a dictionary of kwargs, identical to the kwargs
ofthisfunction.
If the argument is a list, it is expected to be a list of regular
expressions,for which the app-wide configured options are applied.
If the argument is a string, it is expected to be a regular expression
for which the app-wide configured options are applied.
Default : Match all and apply app-level configuration
: type resources: dict, iterable or string
: param origins:
The origin, or list of origins to allow requests from.
The origin(s) may be regular expressions,case-sensitive strings,
or else an asterisk
Default :'*':type origins: list, string or regex
: param methods:
The method or list of methods which the allowed origins are allowed to
access for non-simple requests.
Default :[GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE]:type methods: list or string
: param expose_headers:
The header or list which are safe to expose to the API of a CORS API
specification.
Default : None
: type expose_headers: list or string
: param allow_headers:
The header or list of header field names which can be used when this
resource is accessed by allowed origins. The header(s) may be regular
expressions,case-sensitive strings, or else an asterisk.
Default :'*', allow all headers
: type allow_headers: list, string or regex
: param supports_credentials:
Allows users to make authenticated requests. If true, injects the
` Access-Control-Allow-Credentials` header in responses. This allows
cookies and credentials to be submitted across domains.:note: This option cannot be used in conjuction with a '*' origin
Default : False
: type supports_credentials: bool
: param max_age:
The maximum time for which this CORS request maybe cached. This value
is setas the `Access-Control-Max-Age` header.
Default : None
: type max_age: timedelta, integer, string or None
: param send_wildcard: If True, and the origins parameter is `*`, a wildcard
` Access-Control-Allow-Origin` header is sent, rather than the
request's `Origin` header.
Default : False
: type send_wildcard: bool
: param vary_header:
If True, the header Vary: Origin will be returned as per the W3
implementation guidelines.
Setting this header when the `Access-Control-Allow-Origin` is
dynamically generated(e.g. when there is more than one allowed
origin, and an Origin than '*' is returned) informs CDNs and other
caches that the CORS headers are dynamic, and cannot be cached.
If False, the Vary header will never be injected or altered.
Default : True
: type vary_header: bool
@ cross_originを使用して、単一行ルーティングを構成しますfrom flask import Flask, request
from flask_cors import cross_origin
app =Flask(__name__)
@ app.route('/')
@ cross_origin(supports_credentials=True)
def hello():
name = request.args.get("name","World")return f'Hello, {name}!'
その中で、 cross_originと CORSは基本的に同じパラメータをいくつか提供します。
通常、 origins、 methods、 allow_headers、 supports_credentialsを設定できます
すべての構成項目は次のとおりです。
: param origins:
The origin, or list of origins to allow requests from.
The origin(s) may be regular expressions,case-sensitive strings,
or else an asterisk
Default :'*':type origins: list, string or regex
: param methods:
The method or list of methods which the allowed origins are allowed to
access for non-simple requests.
Default :[GET, HEAD, POST, OPTIONS, PUT, PATCH, DELETE]:type methods: list or string
: param expose_headers:
The header or list which are safe to expose to the API of a CORS API
specification.
Default : None
: type expose_headers: list or string
: param allow_headers:
The header or list of header field names which can be used when this
resource is accessed by allowed origins. The header(s) may be regular
expressions,case-sensitive strings, or else an asterisk.
Default :'*', allow all headers
: type allow_headers: list, string or regex
: param supports_credentials:
Allows users to make authenticated requests. If true, injects the
` Access-Control-Allow-Credentials` header in responses. This allows
cookies and credentials to be submitted across domains.:note: This option cannot be used in conjuction with a '*' origin
Default : False
: type supports_credentials: bool
: param max_age:
The maximum time for which this CORS request maybe cached. This value
is setas the `Access-Control-Max-Age` header.
Default : None
: type max_age: timedelta, integer, string or None
: param send_wildcard: If True, and the origins parameter is `*`, a wildcard
` Access-Control-Allow-Origin` header is sent, rather than the
request's `Origin` header.
Default : False
: type send_wildcard: bool
: param vary_header:
If True, the header Vary: Origin will be returned as per the W3
implementation guidelines.
Setting this header when the `Access-Control-Allow-Origin` is
dynamically generated(e.g. when there is more than one allowed
origin, and an Origin than '*' is returned) informs CDNs and other
caches that the CORS headers are dynamic, and cannot be cached.
If False, the Vary header will never be injected or altered.
Default : True
: type vary_header: bool
: param automatic_options:
Only applies to the `cross_origin` decorator. If True, Flask-CORS will
override Flask's default OPTIONS handling to return CORS headers for
OPTIONS requests.
Default : True
: type automatic_options: bool
| パラメータ | タイプ | ヘッド | デフォルト | 説明 |
|---|---|---|---|---|
| リソース | 辞書、イテレーター、または文字列 | なし | すべて | クロスドメインルーティングインターフェイスを構成する |
| オリジン | リスト、文字列、または正規表現 | Access-Control-Allow-Origin | * | クロスドメインアクセスを許可するオリジンを構成します |
| メソッド | リスト、文字列 | アクセス-制御-許可-メソッド | [GET、HEAD、POST、OPTIONS、PUT、PATCH、DELETE] | クロスドメインサポートリクエストメソッドの構成 |
| Exposure_headers | list、string | Access-Control-Expose-Headers | None | リクエストレスポンスのヘッダー情報をカスタマイズする |
| allow_headers | リスト、文字列、または通常の式 | Access-Control-Request-Headers | * | クロスドメインを許可する要求ヘッダーを構成する |
| support_credentials | Boolean | Access-Control-Allow-Credentials | False | リクエストにCookieの送信を許可するかどうか |
| max_age | timedelta、integer、string | Access-Control-Max-Age | None | プリフライトリクエストの有効期間 |
フラスコのクロスドメイン構成では、 flask-corsを使用して構成できます。ここで、CORS関数はグローバル構成に使用され、 @ cross_originは特定のルーティング構成を実装するために使用されます。