Class yii\filters\Cors

Cors 过滤工具 Cross Origin Resource Sharing.

请务必仔细阅读 CORS 能做的和不能做的事情。CORS 不保护您的 API， 但是允许开发人员授予对第三方代码的访问权限（来自外部域的 Ajax 调用）。

您可以通过将 CORS 筛选器作为行为附加到控制器或模块来使用 CORS 筛选器，如下所示：

public function behaviors()
{
    return [
        'corsFilter' => [
            'class' => \yii\filters\Cors::className(),
        ],
    ];
}

CORS 过滤器可以专门用于限制参数，如下所示， MDN CORS Information

public function behaviors()
{
    return [
        'corsFilter' => [
            'class' => \yii\filters\Cors::className(),
            'cors' => [
                // restrict access to
                'Origin' => ['http://www.myserver.com', 'https://www.myserver.com'],
                // Allow only POST and PUT methods
                'Access-Control-Request-Method' => ['POST', 'PUT'],
                // Allow only headers 'X-Wsse'
                'Access-Control-Request-Headers' => ['X-Wsse'],
                // Allow credentials (cookies, authorization headers, etc.) to be exposed to the browser
                'Access-Control-Allow-Credentials' => true,
                // Allow OPTIONS caching
                'Access-Control-Max-Age' => 3600,
                // Allow the X-Pagination-Current-Page header to be exposed to the browser.
                'Access-Control-Expose-Headers' => ['X-Pagination-Current-Page'],
            ],

        ],
    ];
}

有关如何将 CORS 过滤器添加到控制器的详细信息， 请参见 Guide on REST controllers。