Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
1 x* J" @/ ]# S( v# T2 B

/ d& a  X% Q" T4 D6 e/ ]* t$ v4 d

# CORS header support
1 R' W' u+ g% _% H( t#
2 G1 H6 a& [4 t; C# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
) H7 k  f1 o. [  j#
#   include cors_support;
& n# Y- T* d, I- b( f( B8 J: y8 C+ k#
& H  N2 A- \, G& m* `0 V! r# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
5 W  p. D- C/ f#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
2 U) T. P0 w6 ]- X& _  C3 X
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
" ~8 U' r$ j3 X2 A" G        set $cors 'true';
% t: A& s% a9 o8 U3 j5 p' `}
/ o6 p! m) y# D3 r/ ]# w" H
if ($cors = 'true') {
$ E6 L$ r0 C  i4 ]        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
0 {/ V: Z/ c, B3 T        add_header 'Access-Control-Allow-Credentials' 'true' always;
3 ~5 j& Z; M/ _+ [: C$ H! H        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
7 ^2 [$ R( t4 A: N6 a( H
& I, u  Z  z! @1 w6 j# d  Cif ($request_method = 'OPTIONS') {
- a& B" n3 Y0 o$ }        # Tell client that this pre-flight info is valid for 20 days
: ?! T5 D& q- T9 W$ B! w        add_header 'Access-Control-Max-Age' 1728000;
3 @: \! m, ~, ]- G) u+ t        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
% X* l0 |8 |7 R; \8 S- V        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
- ?% p; N5 j' k8 R7 j9 ]set $origin $http_origin;
) q) |) o- A6 H7 x' pif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
  J! H- f# S3 P3 a8 q" F}
8 N4 ?" D/ J" y8 q$ L. i/ s6 `if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
/ W/ `  I4 U& L4 Z     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
( m( N4 m) q8 i( l2 {9 H" j     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
}
) m& x( f6 f& C( e6 x' d; oif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
9 Y3 z7 E' M0 s* j# u9 z8 S8 ~     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
; M" e# Y" O& M( ]- J7 a" Y     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
0 |* r# m; k! Z% c& v- c}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
& V& I$ G+ C3 D% {; V. ]. U#
; ^: {7 _3 ^, g9 [* t1 D4 V7 S8 g# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
4 @0 C2 @& n6 v- b* h#
9 O: x2 K1 F% M7 }0 h# Despite the W3C guidance suggesting that a list of origins can be passed as part of
0 I1 ]! z" S) C3 Y4 y* z# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
& M6 G0 J2 F+ j( p) f* O#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
$ r" X4 Q" S. A# Z! L5 Z0 v# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.

location / {
/ `# @  Y9 C  ]8 R+ K& H9 V
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
0 |# d4 K4 E2 T
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
7 s% O& }; ^; ?) _7 e3 M    # Determine the HTTP request method used
7 L$ ]9 j3 ]8 w- f  e    if ($request_method = 'OPTIONS') {
5 h. P: T. K3 e( n; S        set $cors "${cors}options";
, h# n# i! a7 W1 {% W: X) l    }
' w9 L, O- q; }9 u    if ($request_method = 'GET') {
        set $cors "${cors}get";
* t' z) \: E" h' z    }
, B" |. X6 \' A2 i& J" L    if ($request_method = 'POST') {
3 K  B0 F  t8 {4 V( j; h* X) h        set $cors "${cors}post";
    }
# b* A# w) k% T9 i# @9 b) ~
1 K! S- K* a6 _  E" }( a& y    if ($cors = "true") {
! {4 d6 j5 D3 l0 w4 ^7 M! L        # Catch all incase there's a request method we're not dealing with properly
2 g. g6 s7 |' s' J# M        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

    if ($cors = "trueget") {
* r! F; b& O  V3 u4 z        add_header 'Access-Control-Allow-Origin' "$http_origin";
! d- u# Y5 k2 J4 t  F        add_header 'Access-Control-Allow-Credentials' 'true';
3 E, U5 s4 `9 d3 |        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
2 N2 T6 p) u% J1 v+ [        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
* m, Z- E0 }7 J
    if ($cors = "trueoptions") {
$ q, ~+ @& A2 u! I( R" f        add_header 'Access-Control-Allow-Origin' "$http_origin";

- y3 z1 m+ ]+ R7 I$ s        #
7 r1 ~9 [* v& f. ~: C        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
        # Custom headers and headers various browsers *should* be OK with but aren't
, T+ o. ~6 J6 A- K5 |8 P        #
: |3 o( r5 P2 H. f# ]# z! Z: b        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
4 x# [( Z9 N0 X+ t        #
        add_header 'Access-Control-Max-Age' 1728000;
0 r. T  J' w' ~: n        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
5 S; Z/ Y1 I& B; t        return 204;
: D  u& q5 m; P- Q$ z2 P( i    }

" @0 n- H0 l2 C: t  z5 {+ ]! h    if ($cors = "truepost") {
! D/ I( x0 d4 H9 e2 {        add_header 'Access-Control-Allow-Origin' "$http_origin";
) _4 @2 k0 i9 |- V+ [        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
: }1 G$ c. r; k# w; V& H        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

}

5 C# G$ M7 c; P; e: ]
: I% D5 O: ^. x# c