Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
. x* A1 j7 y8 H* v4 H9 p' i! y

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
0 Q, x0 \) L6 h  k) p# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
9 K) ?( l4 y+ g% @#
#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
; q, w4 q  m& t# Forked from this Gist: https://gist.github.com/michiel/1064640
#

set $cors '';
% n3 o* X9 G6 x! N7 iif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
}
! {2 Q! e/ [* m
if ($cors = 'true') {
5 S  K% @6 I) s. s        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
6 j  j- B) i  Q- m( u        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
$ p% \' S8 [  Y: t}

if ($request_method = 'OPTIONS') {
( Q  y. d6 X# r9 D( \$ z: Y, ^        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
' i1 _3 I& p# I        add_header 'Content-Length' 0;
8 k, r5 `7 _0 m# A# r        return 204;
* K" }6 o) }% I4 p}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
% ^( S) Q5 x* S5 L' W

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
5 \* P9 Y( B: a( w}
set $origin $http_origin;
" ?9 b1 \# J5 Q: s% nif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
& `6 \% m& e! L! V}
! l2 u* @' Y+ {, |+ t9 Xif ($request_method = 'OPTIONS') {
+ R4 r3 K% V* v: ]" u$ a0 w# Z* Z     add_header 'Access-Control-Allow-Origin' "$origin" always;
0 u5 y7 A2 V% g/ b; u     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
$ ~7 Q' w  p# m+ r  u8 l9 O+ M/ _     add_header 'Access-Control-Allow-Credentials' 'true' always;
/ y- `; Y! T& y* Z, d     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
: y3 q, k+ B2 V3 R! `     return 204;
2 {* ]9 z: Y+ I( n}
! K& i4 U5 C* {# [  I/ pif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
0 J* b' T5 K/ O     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
# k/ n" r6 u0 b, W. {7 R/ ]     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
4 J% g& m4 `6 s! z  j}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
" h% C. D4 f) Q+ Y6 ~' X8 B#
# Slightly tighter CORS config for nginx
2 r/ y9 X# ^/ X: c5 I3 W# r! O#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
$ d7 N( U3 J( R7 p+ G0 I# Despite the W3C guidance suggesting that a list of origins can be passed as part of
2 F( I, D8 T2 y5 J. j+ \# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
$ S. H( }: B5 l, W; v# don't seem to play nicely with this.
3 X( p6 j2 k' z6 D2 Q! q#
5 d0 P' i. p. }$ M# r" @# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.

location / {
/ g, w8 o: K. w! e$ t% s
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
$ g9 O, n9 J* e! V6 k& @* T    }
; c: y2 y! C: j  {1 l
1 a. ]2 [3 l( N8 S# A* }3 J    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
' M8 f# x( I$ O  Z6 d- s/ j% u    # Determine the HTTP request method used
8 N& x  b8 ~* G9 B    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
/ O4 D/ i" I3 G5 T    }
" V, _1 |  R& l2 Y! u  X: X' d    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
5 N$ d  F* L$ R5 j/ e! [+ ?    if ($request_method = 'POST') {
$ r! |, p# h; ^3 O7 b* M        set $cors "${cors}post";
+ k- H6 V3 F5 e8 r9 `    }
1 T- F4 Y6 f$ V3 y
. x# M5 s6 Q) A; Z; u8 S# a    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
# `  w4 L" P% x: h' r$ ^        add_header 'Access-Control-Allow-Origin' "$http_origin";
! a; D8 ~3 D6 L" y/ r4 g    }
7 A7 A: d+ O5 i( j
    if ($cors = "trueget") {
/ B5 v# e9 H. D8 B- Q# m" m        add_header 'Access-Control-Allow-Origin' "$http_origin";
0 H" u' F; ~1 h        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
. j9 _+ ~/ Z9 l3 M1 v/ ?        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
8 G' y" v3 v; I$ D( J. z    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
" C( b2 v; ?  ~, A3 Z, @  v        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
0 S6 z( e# i$ D: ^; N6 u% `        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

% R3 F" t6 J2 h0 u4 ^8 i& \        #
8 q5 s4 z- ?4 D$ S* b        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
/ d" W7 P7 E# n9 r        #
& o' f( F; b1 j        add_header 'Access-Control-Max-Age' 1728000;
) P) x1 S0 P! s        add_header 'Content-Type' 'text/plain charset=UTF-8';
3 }( W4 l( T' o; g8 I' X8 q. l        add_header 'Content-Length' 0;
        return 204;
    }

    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
# @* H4 ]# H6 ]5 w" U% I! h% M& O        add_header 'Access-Control-Allow-Credentials' 'true';
  x: \$ W+ l  z' m        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+ P% t0 V0 H$ X9 V: I1 E# L% G        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
2 m' g" S; {" }3 Z    }
8 i  {6 Y) c- G9 h" W) y; V4 y; Y8 B
}