為 VAST 伺服器設定 CORS
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
新版瀏覽器會將同源安全限制套用至 JavaScript 網路要求，也就是說，從一個來源執行的網路應用程式無法擷取來自不同來源的資料。針對 VAST，這項安全限制可防止從 JavaScript VAST 算繪程式碼產生的 JavaScript XMLHttpRequest 讀取從不同來源提供的 VAST 廣告回應。
這項安全性限制是用來防止問題發生：單一來源能
從使用者可能登入的另一個來源讀取資料
授予使用者的權限這項限制為 JavaScript 放送的 VAST 帶來問題
因為廣告伺服器通常位於
廣告播放器。不過，跨源資源共享 (CORS) 標頭是 W3C 建議，可允許跨不同來源進行共享，藉此克服這項限制。
CORS 標頭
為避免跨來源問題，VAST 廣告伺服器回應 SDK 發出的請求時，也必須
包含下列 HTTP CORS 標頭：
Access-Control-Allow-Origin: <origin header value>
Access-Control-Allow-Credentials: true
這些標頭可讓任何來源的廣告播放器讀取廣告伺服器來源的 VAST 回應。設定 Access-Control-Allow-Origin 的值
與廣告請求一併傳送的 Origin 標頭值。
Access-Control-Allow-Credentials到 true，以確保
確保 Cookie 正確傳送及接收
如需啟用 CORS 的詳細操作說明，請參閱「啟用跨源資源共享」。
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-08-31 (世界標準時間)。
[null,null,["上次更新時間：2025-08-31 (世界標準時間)。"],[[["\u003cp\u003eModern browsers restrict JavaScript from accessing data from different origins for security reasons, impacting VAST ads served from a separate domain than the player.\u003c/p\u003e\n"],["\u003cp\u003eCross-Origin Resource Sharing (CORS) headers enable cross-origin data sharing, allowing VAST ads to be served from a different domain than the player.\u003c/p\u003e\n"],["\u003cp\u003eVAST ad server responses should include specific CORS headers: \u003ccode\u003eAccess-Control-Allow-Origin\u003c/code\u003e (set to the request's \u003ccode\u003eOrigin\u003c/code\u003e header value) and \u003ccode\u003eAccess-Control-Allow-Credentials\u003c/code\u003e (set to \u003ccode\u003etrue\u003c/code\u003e).\u003c/p\u003e\n"]]],[],null,["# Configure CORS for VAST servers\n\nModern browsers apply same-origin security restrictions to JavaScript network\nrequests, meaning that a web application running from one origin cannot retrieve data\nserved from a different origin. For VAST, this security restriction prevents\nJavaScript XMLHttpRequests made from JavaScript VAST rendering code from reading\na VAST ad response served from a different origin.\n\nThis security restriction is meant to prevent issues where one origin is able\nto read data from another origin that a user may be logged in to without that\nuser's permission. The restriction poses problems for VAST served in a JavaScript\nenvironment because an ad server is often on a different domain than the\nads player. However, [Cross-Origin Resource Sharing (CORS)](//www.w3.org/TR/cors)\nheaders is a W3C recommendation that works around this restriction by allowing\nsharing across different origins.\n\nCORS headers\n------------\n\nTo avoid cross-origin problems, VAST ad server responses to requests made by the SDK must\ninclude following HTTP CORS headers: \n\n```text\nAccess-Control-Allow-Origin: \u003corigin header value\u003e\nAccess-Control-Allow-Credentials: true\n```\n\nThese headers allow an ads player on any origin to read the VAST response\nfrom the ad server origin. Set the value of `Access-Control-Allow-Origin`\nto the value of the `Origin` header sent with the ad request, and\n`Access-Control-Allow-Credentials` to `true` to ensure\nthat cookies are sent and received properly.\n\nFor further instructions on enabling CORS, see\n[Enable cross-origin resource sharing](//enable-cors.org/)."]]
