{
  "topic": "cors",
  "type": "single_choice",
  "schema_version": "1.0.0",
  "generated": "2026-09-02T21:20:00+08:00",
  "questions": [
    {
      "id": "sc-001",
      "type": "single_choice",
      "difficulty": 2,
      "tags": [
        "CORS",
        "同源策略"
      ],
      "question": "浏览器同源策略判断跨域的标准是什么？",
      "options": {
        "A": "是否同一台服务器",
        "B": "协议 + 域名 + 端口三元组是否完全一致",
        "C": "是否同一网段",
        "D": "是否使用相同浏览器"
      },
      "answer": "B",
      "explanation": "源（Origin）= 协议 + 域名 + 端口。三者必须完全一致才算同源，任何一个不一样就是跨域，浏览器会拦截。",
      "source": null,
      "related": []
    },
    {
      "id": "sc-002",
      "type": "single_choice",
      "difficulty": 3,
      "tags": [
        "CORS",
        "预检请求"
      ],
      "question": "浏览器在什么情况下会发送 OPTIONS 预检请求？",
      "options": {
        "A": "GET 请求",
        "B": "POST 请求",
        "C": "PUT/DELETE/自定义 Header 等非简单请求",
        "D": "所有请求"
      },
      "answer": "C",
      "explanation": "简单请求（GET/POST/HEAD + 简单 Header）浏览器直接发，看响应头判断。预检请求（PUT/DELETE/自定义 Header 等）浏览器先发 OPTIONS 探路，确认安全后才发真正请求。",
      "source": null,
      "related": []
    },
    {
      "id": "sc-003",
      "type": "single_choice",
      "difficulty": 3,
      "tags": [
        "CORS",
        "Access-Control-Allow-Origin"
      ],
      "question": "Access-Control-Allow-Origin: * 同时带 Cookie 时会怎样？",
      "options": {
        "A": "正常工作",
        "B": "浏览器会拒绝",
        "C": "Cookie 自动删除",
        "D": "请求自动重试"
      },
      "answer": "B",
      "explanation": "当请求携带凭据（Cookie、HTTP Auth）时，Access-Control-Allow-Origin 不能是通配符 *，必须是具体的源。这是为了防止任意网站都能通过你浏览器里的 Cookie 访问受保护资源。",
      "source": null,
      "related": []
    },
    {
      "id": "sc-004",
      "type": "single_choice",
      "difficulty": 2,
      "tags": [
        "CORS",
        "同源"
      ],
      "question": "http://localhost:3000 和 http://localhost:8080 是否同源？",
      "options": {
        "A": "同源",
        "B": "跨域",
        "C": "取决于浏览器",
        "D": "取决于协议"
      },
      "answer": "B",
      "explanation": "端口不同（3000 ≠ 8080）就是跨域。前后端分离开发时极其常见，前端在 3000 端口，后端 API 在 8080 端口。",
      "source": null,
      "related": []
    },
    {
      "id": "sc-005",
      "type": "single_choice",
      "difficulty": 3,
      "tags": [
        "CORS",
        "WebSocket"
      ],
      "question": "WebSocket 不受同源策略限制的原因是什么？",
      "options": {
        "A": "WebSocket 使用 UDP",
        "B": "WebSocket 连接一旦建立就是全双工通信，不受 CORS 限制",
        "C": "WebSocket 自带加密",
        "D": "WebSocket 不经过浏览器"
      },
      "answer": "B",
      "explanation": "WebSocket 连接一旦建立就是全双工通信，不受 CORS 限制。但建立连接的握手阶段（HTTP Upgrade 请求）仍然受同源策略影响。",
      "source": null,
      "related": []
    },
    {
      "id": "sc-006",
      "type": "single_choice",
      "difficulty": 4,
      "tags": [
        "CORS",
        "Nginx"
      ],
      "question": "生产环境中解决跨域最常用的方式是什么？",
      "options": {
        "A": "前端开发代理",
        "B": "Nginx 反向代理",
        "C": "后端设置 CORS 响应头",
        "D": "使用 WebSocket"
      },
      "answer": "B",
      "explanation": "生产环境中 Nginx 反向代理是最常用的方式。前端请求 app.example.com/api/，Nginx 代理到后端 localhost:8080，对浏览器来说是同源。",
      "source": null,
      "related": []
    },
    {
      "id": "sc-007",
      "type": "single_choice",
      "difficulty": 3,
      "tags": [
        "CORS",
        "预检请求"
      ],
      "question": "网络面板里一个请求出现两次，第一次是什么？",
      "options": {
        "A": "重试请求",
        "B": "OPTIONS 预检请求",
        "C": "缓存验证",
        "D": "DNS 解析"
      },
      "answer": "B",
      "explanation": "网络面板里一个请求出现两次，第一次是 OPTIONS 预检请求，不是 bug。浏览器先发 OPTIONS 探路，确认允许后才发真正请求。",
      "source": null,
      "related": []
    },
    {
      "id": "sc-008",
      "type": "single_choice",
      "difficulty": 2,
      "tags": [
        "CORS",
        "同源"
      ],
      "question": "https://app.example.com 和 https://api.example.com 是否同源？",
      "options": {
        "A": "同源",
        "B": "跨域",
        "C": "取决于端口",
        "D": "取决于协议"
      },
      "answer": "B",
      "explanation": "子域名不同（app.example.com ≠ api.example.com）就是跨域。即使在同一台服务器上，子域名不同也属于跨域。",
      "source": null,
      "related": []
    },
    {
      "id": "sc-009",
      "type": "single_choice",
      "difficulty": 4,
      "tags": [
        "CORS",
        "同源策略",
        "安全"
      ],
      "question": "同源策略防止的攻击场景是什么？",
      "options": {
        "A": "DDoS 攻击",
        "B": "恶意网站冒充用户向银行发起请求",
        "C": "SQL 注入",
        "D": "XSS 攻击"
      },
      "answer": "B",
      "explanation": "同源策略防止的典型场景：你登录了银行网站（bank.com），浏览器存了 cookie，然后访问恶意网站（evil.com），evil.com 试图请求 bank.com/api/transfer 冒充你转账。同源策略会拦截这个请求。",
      "source": null,
      "related": []
    },
    {
      "id": "sc-010",
      "type": "single_choice",
      "difficulty": 3,
      "tags": [
        "CORS",
        "Vite"
      ],
      "question": "Vite 开发服务器中 server.proxy 配置的作用是什么？",
      "options": {
        "A": "加速构建",
        "B": "将 /api 请求代理到后端，浏览器看到的请求始终在同源",
        "C": "压缩代码",
        "D": "热更新"
      },
      "answer": "B",
      "explanation": "Vite 的 server.proxy 将 /api 请求代理到后端（如 localhost:8080），浏览器看到的请求始终在 localhost:3000，同源，不触发跨域。changeOrigin: true 修改请求头中的 Host 为目标地址。",
      "source": null,
      "related": []
    }
  ]
}