Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
" p8 `! x8 R, i/ ~

# CORS header support
#
  B8 X' W: n) U4 n7 d, M# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
$ O- y/ S) Y) n7 _#
#   include cors_support;
1 I- N: x6 B! F  U& _6 _#
1 x' L6 N5 G/ I* M6 l) Q: l9 T& l# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
9 d* d: n8 \+ k8 A! O  J/ [# Forked from this Gist: https://gist.github.com/michiel/1064640
#

9 J+ z/ O; q' z1 Y" wset $cors '';
7 @/ B: q3 V! {/ |. o  wif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
$ T! \% k9 K3 c" H, X3 _        set $cors 'true';
}

" c* {& ^' C# H  g/ l/ ^if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
3 B9 C& d6 w- B& h6 x* f        add_header 'Access-Control-Allow-Credentials' 'true' always;
% [- @( M% V# u! Y+ r* G        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
) L! f8 q+ Q( Q7 x  V        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
7 r- E/ E2 ?3 {        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
% F' [7 A5 p4 W+ ~" M  v9 z
! X) e& [0 `: R3 Cif ($request_method = 'OPTIONS') {
$ B8 q. K2 h+ K6 i6 }3 J( x        # Tell client that this pre-flight info is valid for 20 days
; O1 T( x% ~: r3 b7 ^! E$ p        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
% ^1 p% O0 k* _+ V3 m( }}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
# H' W. [' l/ @) Q}
set $origin $http_origin;
+ f& ~1 s  Z# wif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
% c  i+ q1 ~; L8 b) f     set $origin 'https://default.yourdom.zone';
}
4 u' e6 U" w5 e, q8 p* bif ($request_method = 'OPTIONS') {
7 I  P( i) G# s; Y& l4 P  A     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
! G9 A# r( i! ^     add_header 'Access-Control-Allow-Credentials' 'true' always;
" b, F" P& i, M; @- R* U' V( A+ `     add_header Access-Control-Max-Age 1728000;   #20 days   
2 T7 l; u% d( d* C- W  y4 O     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
}
4 }1 O* G: h+ v8 p2 e  ]if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
8 `/ e( U0 l  G  J: J! ~, {     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
7 g, k! u7 i3 Z  m# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
  \/ `8 ?+ o. g! }0 z#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
7 D; F8 z, m$ Q# don't seem to play nicely with this.
( e+ r6 `* T0 S#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
* n1 }5 I. X2 q% v; V# U# NB: This relies on the use of the 'Origin' HTTP Header.

location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
( b7 s# G2 j5 e1 x, {8 ~        set $cors "true";
    }

! }2 Z; a% w! H9 x    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
5 ~+ z+ c2 n, r- t% s    # Determine the HTTP request method used
( g6 G! c% V5 e2 _4 ~' T+ f' W    if ($request_method = 'OPTIONS') {
3 T1 N4 k* }9 Q! D+ W        set $cors "${cors}options";
    }
4 K$ W3 P1 J& Y: M' g. z  y    if ($request_method = 'GET') {
" A: S( q  F. @& L7 F        set $cors "${cors}get";
) {1 R  Z0 C- e1 X4 v  `0 ~    }
    if ($request_method = 'POST') {
3 P3 c9 d9 n4 {& K' [$ _! \; W' J        set $cors "${cors}post";
    }

    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
7 L8 Y; z$ z( v
( y# }9 O2 I5 K7 s    if ($cors = "trueget") {
& ]  Q& j' |7 x        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
$ M$ }2 a' _! X4 v    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
/ k2 t: l- R. c9 ]; N2 C/ Q
        #
        # Om nom nom cookies
* x7 v1 }1 l1 X0 ?; ?2 m' t) l2 A        #
        add_header 'Access-Control-Allow-Credentials' 'true';
/ }9 M. B$ e7 A& A- {. A. q        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
  z: w  f3 m7 B( H& W& S6 p
: F8 H8 n/ K: z, q        #
! P0 _; [  E7 h6 q8 k        # Custom headers and headers various browsers *should* be OK with but aren't
- _/ `) B" v/ J        #
/ u9 p" _: O$ I/ P: m9 S, N        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
# t; I/ h+ A: M7 ^        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
7 S* o. O- V4 \        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
% V0 ^4 e% {# c1 h( t    }

7 B! k1 r( P( Y    if ($cors = "truepost") {
2 h$ \$ f1 l  R! ~        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
4 C3 X& p$ ^3 P+ q2 H' ~- Q- U        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
  Z' ]* k+ i4 u        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
& R, g  s5 I5 e' _: @: F% v    }

}

4 L6 _0 @, u  n5 O/ D  z" Y5 N