php 在服務端程式碼裡面加 header資訊

header("Access-Control-Allow-Origin: *"); //如果需要設定允許所有域名發起的跨域請求，可以使用萬用字元 *
或者
header("Access-Control-Allow-Origin: www.xxx.xom");

Java中設定多個Access-Control-Allow-Origin跨域訪問

1、如果服務端是Java開發的，新增如下設定允許跨域即可，但是這樣做是允許所有域名都可以訪問，不夠安全。
response.setHeader("Access-Control-Allow-Origin","*");

public void doFilter(ServletRequest req, ServletResponse res,FilterChain chain) throws IOException, ServletException {
        // 將ServletResponse轉換為HttpServletResponse
        HttpServletResponse httpResponse = (HttpServletResponse) res;
        // 如果不是80埠,需要將埠加上,如果是叢集,則用Nginx的地址,同理不是80埠要加上埠
    String []  allowDomain= {"http://www.baidu.com","http://123.456.789.10","http://123.16.12.23:8080"};
    Set allowedOrigins= new HashSet(Arrays.asList(allowDomain));
    String originHeader=((HttpServletRequest) req).getHeader("Origin");
    if (allowedOrigins.contains(originHeader)){
        httpResponse.setHeader("Access-Control-Allow-Origin", originHeader);
            httpResponse.setContentType("application/json;charset=UTF-8");
            httpResponse.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
            httpResponse.setHeader("Access-Control-Max-Age", "3600");
            httpResponse.setHeader("Access-Control-Allow-Headers", "Content-Type,Access-Token");
            // 如果要把Cookie發到伺服器，需要指定Access-Control-Allow-Credentials欄位為true
            httpResponse.setHeader("Access-Control-Allow-Credentials", "true");                                
            httpResponse.setHeader("Access-Control-Expose-Headers", "*");        
        }        
        chain.doFilter(req, res);
} 
 

基於nginx配置請求的CORS

目前很多請求都不是直接暴露的，很多通過nginx做反向代理，因此可以使用nginx配置固定請求的Access-Control-Allow-Origin，實現跨域訪問。方式是在被請求的介面，配置location代理，新增header實現。

add_header Access-Control-Allow-Origin *;
add_header Access-Control-Allow-Credentials true;
add_header Access-Control-Allow-Headers "x-requested-with,Authorization";
 
add_header Access-Control-Allow-Methods *;

更多參考：https://www.jianshu.com/p/3967c00cca09