Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源 - 52AV手機A片王|52AV.ONE

# CORS header support
4 P% R9 b8 }3 M  U+ X! Y1 f#
2 ~5 C; M* ~5 [  T* a1 S0 M# One way to use this is by placing it into a file called "cors_support"
5 L' _, V; `4 D6 v0 K# under your Nginx configuration directory and placing the following
  q4 H. C1 ?# z% T1 r: i# statement inside your **location** block(s):) \8 l, C( H& N
#7 M; n8 K2 b$ _1 L4 |/ J
# include cors_support;
( u7 M+ J1 [' l4 ~3 t* Y9 i  i#
, O8 E8 L% D( ]# As of Nginx 1.7.5, add_header supports an "always" parameter which9 ?( k' `: K" \& h" K6 H9 {% K! ^
# allows CORS to work if the backend returns 4xx or 5xx status code.
2 K: E9 v: J: O7 t) J8 @#1 k1 |- N4 h- p0 f% [. q& e7 |! }
# For more information on CORS, please see: http://enable-cors.org/# J$ T2 D5 h* v7 r5 o+ y! e$ v
# Forked from this Gist: https://gist.github.com/michiel/1064640% _) Y3 ?/ M. i1 X, z& u
#
! p% w' Q) ?* Z& F- u! s; e2 G9 T% t0 R+ V# v3 q! s
set $cors '';& y' \& n0 q: l. ^. N$ B( X! V
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {- W" k8 R& H! f& D' N3 q; D% L8 S
      set $cors 'true';* w1 A- b) Q4 ^3 @6 `" j7 d0 t
}' M% g2 `2 z* S7 G/ l5 k; I, p- L
; }0 h( U" I+ x1 R9 Z+ u0 ^3 A
if ($cors = 'true') {, K1 ?9 @, u5 ^+ X. i1 v, \: V0 n
      add_header 'Access-Control-Allow-Origin' "$http_origin" always;
& u$ ~9 u" c3 a6 u* d       add_header 'Access-Control-Allow-Credentials' 'true' always;  x0 y- W$ ^* m( [; @7 I
      add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;& D. A, R0 I' \8 _$ H/ x
      add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
) l9 m# o3 o. ]0 X6 F0 h$ p       # required to be able to read Authorization header in frontend! Q3 s; ?& e  r% ^  P% E
      #add_header 'Access-Control-Expose-Headers' 'Authorization' always;* B" }+ D& a0 A# _0 P0 k
}$ d) g# t' ]0 _) w' _

# O3 j( Y) ^& u9 q8 @if ($request_method = 'OPTIONS') {+ ]! G1 B! ?1 z0 A5 R6 c
      # Tell client that this pre-flight info is valid for 20 days
4 l+ e8 ^5 x0 G0 x4 N       add_header 'Access-Control-Max-Age' 1728000;7 e+ {4 `$ J0 m- a
      add_header 'Content-Type' 'text/plain charset=UTF-8';
7 z% c* C% S) ?6 Z$ y       add_header 'Content-Length' 0;
1 W9 M3 X! g! D: C& z       return 204;8 D+ U. Q/ S* M8 Q
}

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {    return 444;8 K9 D9 y8 s( `# \+ C1 R4 E( f, X
}
8 p0 e. T8 S5 {/ f  Cset $origin $http_origin;; g, W3 Y( g3 P' ^6 o
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {2 L8 J7 E4 E% {" `+ L6 B! [, f
   set $origin 'https://default.yourdom.zone';
' E: w+ [% ?5 Y- s}. X+ w$ }1 {' y* B% w% F) f1 o7 S
if ($request_method = 'OPTIONS') {* p( P: v2 t  ?, ~8 _- ^
   add_header 'Access-Control-Allow-Origin' "$origin" always;
8 }4 G- M' f& M1 Q. d* Q    add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;+ B; c! e3 D! O( j7 B
   add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
: i" X5 K" ?4 T7 S5 [5 B    add_header 'Access-Control-Allow-Credentials' 'true' always;% Q+ E( P+ I) r" Z1 J4 C9 C! M
   add_header Access-Control-Max-Age 1728000; #20 days 1 O: e3 b( V" J8 b' e' ]* O
   add_header Content-Type 'text/plain charset=UTF-8';
6 a& W" \# D- A8 D, F0 T- G    add_header Content-Length 0;. p# p2 j! G% r, t0 q3 A" a
   return 204;7 X6 u# T8 j6 x  N# j1 i. x
}
) K9 l' r! Z/ j. y# p( Xif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
; u9 V% y+ F0 y) ?0 ]( e    add_header Access-Control-Allow-Origin "$origin" always;
  C) R! R1 I+ p7 R8 Z5 X    add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;7 u5 m+ O: e3 a- ?% U
   add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;0 Y# S" [! L+ b9 K
   add_header Access-Control-Allow-Credentials true always;  q: Y' K1 m3 r. p% G
}

# based on https://gist.github.com/4165271/
) Z" k% R' x2 E; {0 i8 M#/ R+ b4 Z$ |/ S* x) t
# Slightly tighter CORS config for nginx% u* \6 u* E6 U, K
#
5 R4 ~6 P7 u3 p" e% Q# A modification of https://gist.github.com/1064640/ to include a white-list of URLs7 Y: ^+ R7 [+ X1 p
#
. S9 [7 S  T! Y( N2 {# Despite the W3C guidance suggesting that a list of origins can be passed as part of+ |7 t  ]' X( \, [: d
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
: I7 A# Z# P6 Q, p# don't seem to play nicely with this.
3 w& S5 {  k7 ]) `2 a2 F#
- d3 B) r; Q( B# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.! G$ ^# C$ I; e
#
& c! Y2 l8 K, g% ^6 w9 j3 q1 b# NB: This relies on the use of the 'Origin' HTTP Header.& _" |- m: O6 Q; j; n- `

  A/ c7 Z6 ]; Vlocation / {8 \% f2 e6 m- Q# _: C4 b: s1 z
! I# ]4 l) j5 T5 N
if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
: f" E4 B& c5 M  a. c- J       set $cors "true";& x! W& X4 |) H
}
" X, q4 V4 n% ?# v9 E- }) G* R. _* s0 k3 ?6 W. a
# Nginx doesn't support nested If statements. This is where things get slightly nasty.0 c( _- o7 [4 ], i9 U
# Determine the HTTP request method used
& i" M8 Y* A) H* u: h$ ? if ($request_method = 'OPTIONS') {6 D2 v2 e+ m3 A% I1 e: C0 X
      set $cors "${cors}options";# }$ w: M) x5 H% G' J" y
}
# s; \7 s8 p" v$ X& G6 Y if ($request_method = 'GET') {" r6 K/ G, p# i0 D3 J. r
      set $cors "${cors}get";* j+ B" [7 S6 a! K/ F' Y
}
) z0 l. j# K# v if ($request_method = 'POST') {
  z7 A2 j7 j8 K0 ?       set $cors "${cors}post";
8 U) ~# S' e7 ?5 }0 f6 C- B  d }
5 G4 ?) [9 D1 @) x2 s3 V
3 D6 E7 [7 x: F3 z" Q5 n if ($cors = "true") {
# w& L: L1 t( Q1 |       # Catch all incase there's a request method we're not dealing with properly' W( Q/ R( ~$ w1 s9 C- H: e$ C
      add_header 'Access-Control-Allow-Origin' "$http_origin";
: G) Y9 _& Q8 v' E' i1 c7 u }
% C2 f! l* N) Y/ q; z* X* X1 ~( Y# O5 n/ f5 ^! C
if ($cors = "trueget") {' Q7 k$ z" }" n& t$ R, m" o5 T+ P( V: \
      add_header 'Access-Control-Allow-Origin' "$http_origin";0 C6 ]5 e9 B* W( R4 l6 I
      add_header 'Access-Control-Allow-Credentials' 'true';
0 b) @+ F& t  v9 _; y$ x  [; s       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';6 k7 y2 I; x9 \0 W4 V( L+ i) G
      add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
. W! P" f$ O3 U$ U }
  r8 q! Z- M1 Z; l) s6 }' k/ A" b) Q$ ~' [5 T' L
if ($cors = "trueoptions") {) ^. d* l5 p9 T6 P1 W
      add_header 'Access-Control-Allow-Origin' "$http_origin";: \: }4 ?0 R+ ?% n5 A' \1 X& n

; b( J3 ^0 o4 k: c  B' {/ B' [       #
0 Q& q; c2 D+ C: j       # Om nom nom cookies  \; b( o5 [% Q+ h! ^
      #" g& O6 {9 G" a3 G6 w
      add_header 'Access-Control-Allow-Credentials' 'true';
, I( g* P. c: U" t& F" A% G       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
4 i" Z$ \% E/ d' p" i2 J, y2 n/ D3 Q. d
      #
" O8 d. r1 C' r% r       # Custom headers and headers various browsers *should* be OK with but aren't
* m/ }9 t3 t# k, D( _. ~; ^       #
) C! u. N  u( y6 D0 {8 v       add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
" x, W& J  w# m+ V8 Q2 R
      #+ t/ _2 W. p! ~: J. O# I
      # Tell client that this pre-flight info is valid for 20 days5 `% y# Q6 R- O3 p: _- v
      #/ _. C! x9 V. {7 K6 Q& f" I+ U
      add_header 'Access-Control-Max-Age' 1728000;( N/ }. h- X! ]. F, a
      add_header 'Content-Type' 'text/plain charset=UTF-8';
7 W5 n" b3 G/ U- L0 F; H2 |       add_header 'Content-Length' 0;5 |% R1 t) m9 W+ m0 f5 S
      return 204;2 c2 t1 @8 d& H8 m: k6 R
}4 q% W* G6 i8 U* J$ H

6 v# O) p3 B; v" E' A0 | if ($cors = "truepost") {
1 W/ @- ^& r* X       add_header 'Access-Control-Allow-Origin' "$http_origin";& a2 o: x# H7 A' \
      add_header 'Access-Control-Allow-Credentials' 'true';
0 `" {( I" J* b       add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';  P( R+ Z% C4 H7 j5 t: k4 J
      add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
! n7 O1 k6 v, }3 _3 q4 q* V }3 X% f$ I2 E- D  Q- R" G7 {
9 ?5 G  }1 r  U8 q
}