Golang处理跨域请求怎么做 配置CORS中间件方案

github.com/rs/cors

rs/cors

net/http

gorilla/mux

gin

go get github.com/rs/cors

net/http

package main

import (
    "net/http"
    "github.com/rs/cors"
)

func main() {
    mux := http.NewServeMux()
    mux.HandleFunc("/api/hello", func(w http.ResponseWriter, r *http.Request) {
        w.Header().Set("Content-Type", "application/json")
        w.Write([]byte(`{"message": "Hello CORS!"}`))
    })

    // 配置 CORS 中间件
    c := cors.New(cors.Options{
        AllowedOrigins:   []string{"http://localhost:3000", "https://your-frontend.com"}, // 允许的前端域名
        AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
        AllowedHeaders:   []string{"*"}, // 允许所有头部，也可以指定如 "Content-Type", "Authorization"
        ExposedHeaders:   []string{"Content-Length"},
        AllowCredentials: true, // 允许携带凭证（如 cookies）
        MaxAge:           3600, // 预检请求缓存时间（秒）
    })

    // 将 CORS 中间件包装在 handler 外层
    handler := c.Handler(mux)
    http.ListenAndServe(":8080", handler)
}

rs/cors

rs/cors

rs/cors

package main

import (
    "github.com/gin-gonic/gin"
    "github.com/rs/cors"
    "net/http"
)

func main() {
    r := gin.Default()

    r.GET("/api/hello", func(c *gin.Context) {
        c.JSON(http.StatusOK, gin.H{
            "message": "Hello from Gin with CORS",
        })
    })

    // 使用 rs/cors 包装
    corsMiddleware := cors.New(cors.Options{
        AllowedOrigins: []string{"http://localhost:3000"},
        AllowedMethods: []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
        AllowedHeaders: []string{"*"},
        AllowCredentials: true,
    })

    handler := corsMiddleware.Handler(r)
    http.ListenAndServe(":8080", handler)
}

r.Use(func(c *gin.Context) {
    c.Header("Access-Control-Allow-Origin", "http://localhost:3000")
    c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
    c.Header("Access-Control-Allow-Headers", "Content-Type, Authorization")

    if c.Request.Method == "OPTIONS" {
        c.AbortWithStatus(204)
        return
    }
    c.Next()
})

MaxAge

Access-Control-Allow-Origin

同时携带凭证** 如果前端发送了

，服务端

，那么

必须是具体域名，不能是

rs/cors

AllowedOrigins: []string{"*"}

rs/cors

AllowOriginFunc

AllowOriginFunc: func(r *http.Request, origin string) bool {
    return origin == "http://localhost:3000"
},

rs/cors