为 VAST 服务器配置 CORS
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
新型浏览器会对 JavaScript 网络请求应用同源安全限制，这意味着从一个来源运行的 Web 应用无法检索从其他来源提供的数据。对于 VAST，这种安全限制可防止
从 JavaScript VAST 呈现代码发出的 JavaScript XMLHttpRequests 读取
从其他来源投放的 VAST 广告响应。
此安全限制是为了防止问题
从另一个来源读取用户无需该来源即可登录的数据
获得用户许可。该限制给在 JavaScript 中投放的 VAST 带来了问题
因为广告服务器通常与
。不过，W3C 建议使用跨源资源共享 (CORS) 标头来规避此限制，因为该标头允许跨不同源共享资源。
CORS 标头
为避免跨源问题，VAST 广告服务器对 SDK 发出的请求的响应必须包含以下 HTTP CORS 标头：
Access-Control-Allow-Origin: <origin header value>
Access-Control-Allow-Credentials: true
通过这些标头，任何来源的广告播放器都可以从广告服务器来源读取 VAST 响应。将 Access-Control-Allow-Origin 的值设置为随广告请求一起发送的 Origin 标头的值，并将 Access-Control-Allow-Credentials 设置为 true，以确保正确发送和接收 Cookie。
如需详细了解如何启用 CORS，请参阅
启用跨源资源共享。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-31。
[null,null,["最后更新时间 (UTC)：2025-08-31。"],[[["\u003cp\u003eModern browsers restrict JavaScript from accessing data from different origins for security reasons, impacting VAST ads served from a separate domain than the player.\u003c/p\u003e\n"],["\u003cp\u003eCross-Origin Resource Sharing (CORS) headers enable cross-origin data sharing, allowing VAST ads to be served from a different domain than the player.\u003c/p\u003e\n"],["\u003cp\u003eVAST ad server responses should include specific CORS headers: \u003ccode\u003eAccess-Control-Allow-Origin\u003c/code\u003e (set to the request's \u003ccode\u003eOrigin\u003c/code\u003e header value) and \u003ccode\u003eAccess-Control-Allow-Credentials\u003c/code\u003e (set to \u003ccode\u003etrue\u003c/code\u003e).\u003c/p\u003e\n"]]],[],null,["# Configure CORS for VAST servers\n\nModern browsers apply same-origin security restrictions to JavaScript network\nrequests, meaning that a web application running from one origin cannot retrieve data\nserved from a different origin. For VAST, this security restriction prevents\nJavaScript XMLHttpRequests made from JavaScript VAST rendering code from reading\na VAST ad response served from a different origin.\n\nThis security restriction is meant to prevent issues where one origin is able\nto read data from another origin that a user may be logged in to without that\nuser's permission. The restriction poses problems for VAST served in a JavaScript\nenvironment because an ad server is often on a different domain than the\nads player. However, [Cross-Origin Resource Sharing (CORS)](//www.w3.org/TR/cors)\nheaders is a W3C recommendation that works around this restriction by allowing\nsharing across different origins.\n\nCORS headers\n------------\n\nTo avoid cross-origin problems, VAST ad server responses to requests made by the SDK must\ninclude following HTTP CORS headers: \n\n```text\nAccess-Control-Allow-Origin: \u003corigin header value\u003e\nAccess-Control-Allow-Credentials: true\n```\n\nThese headers allow an ads player on any origin to read the VAST response\nfrom the ad server origin. Set the value of `Access-Control-Allow-Origin`\nto the value of the `Origin` header sent with the ad request, and\n`Access-Control-Allow-Credentials` to `true` to ensure\nthat cookies are sent and received properly.\n\nFor further instructions on enabling CORS, see\n[Enable cross-origin resource sharing](//enable-cors.org/)."]]
