Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
  P# g# T1 b/ L4 j. D

# CORS header support
  E, h! `$ U/ i4 H: p: |#
4 T* T7 k& Y  a! a4 z# One way to use this is by placing it into a file called "cors_support"
' ]6 S) k+ h8 T# e- c# under your Nginx configuration directory and placing the following
/ w) R5 ~/ Z9 x. K& B6 b# statement inside your **location** block(s):
#
* k/ U1 X, v# E+ ]/ c0 V#   include cors_support;
- W  p- \9 B2 f: R) H0 }#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
; j' H7 c! [# W) F6 L% T7 Y7 [#
" \! P% o3 p" ^$ d; ]* K7 z, B# For more information on CORS, please see: http://enable-cors.org/
  }+ r4 B3 S: ~3 y: s8 X) l# Forked from this Gist: https://gist.github.com/michiel/1064640
#
- `/ l: r% K* S, a! Z9 Y4 D
set $cors '';
! T" g+ O, Z7 f0 V7 u2 cif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
3 f$ ], u: r* L1 j( R5 Y        set $cors 'true';
8 z" k! t. \! U}
0 j$ N3 K$ L/ L+ T0 x. ^
if ($cors = 'true') {
# g) [. x8 D1 l3 w( r        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
- |. K2 `/ M+ z        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
. {9 k' I- a9 A( D/ Z}

' {  {+ {+ U  k! qif ($request_method = 'OPTIONS') {
$ S& M9 `7 R$ e* }) m8 p        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
- W$ {; l  s" A. I$ Z1 m1 \        add_header 'Content-Type' 'text/plain charset=UTF-8';
6 S& c6 f4 Z% ~; @. E) J3 h/ F        add_header 'Content-Length' 0;
        return 204;
" b( S$ ^& I+ p8 g}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
4 ~1 `7 M, Q) J" \" ~. M

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
: g0 w/ G6 P+ h; d5 Iif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
) i0 u( Z. H' C8 |     set $origin 'https://default.yourdom.zone';
) W8 K7 f% z& S( u4 ]* O' u}
if ($request_method = 'OPTIONS') {
0 {: o5 M1 h. {0 _     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
/ D0 j5 _* n. ~/ s     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
5 y6 q. V& r$ w$ B3 l( u     add_header Content-Length 0;
, a1 {- @. L, O     return 204;
}
$ T9 b( {% {, R7 |2 M9 G7 f0 Jif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
- N4 I6 S4 d) ^     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
" q; ~4 f/ w/ p" t7 g     add_header Access-Control-Allow-Credentials true always;
" m: _0 Y9 E( W7 o! [9 r}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
- P4 \0 T7 U; l) L! ?( t3 N5 t#
# `# a, t- |, H8 h# Slightly tighter CORS config for nginx
# ^& M9 S6 k3 p7 r$ J#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
, `  B9 w2 D, `! I5 l#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
" K) n, m4 q4 \8 ~. i8 i# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
& m5 ?! k& m, F. h1 q#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
$ J( k* Q5 V. ~# method to control access instead.
7 G7 Q% j2 d& f% [& p7 F#
/ I5 s$ K! V$ L( z: X# NB: This relies on the use of the 'Origin' HTTP Header.
8 N- p- {/ P6 s* g5 B
location / {

! @7 W' ]  {$ E" w    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
( Q+ G, Q5 K9 u3 J/ W# m+ ]    if ($request_method = 'OPTIONS') {
. [3 |& y5 Z/ N! a6 e0 M        set $cors "${cors}options";
# w' n5 a$ P& A/ I" h0 G* W% m    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
4 s* ]; f/ i% b) i8 \    }
! k1 }$ S  x# t' D- z- d    if ($request_method = 'POST') {
) O. Q- _4 @: y7 H- H        set $cors "${cors}post";
- x( M, C9 E# X8 X    }
! L* I. c2 x4 H$ f* p
    if ($cors = "true") {
6 K( f* N' N/ F8 Y8 O( L4 _        # Catch all incase there's a request method we're not dealing with properly
4 t, Y4 N, E1 Z+ z9 V- C" Y        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
  Z, d/ f- ]' \8 C! Z7 P, |
0 S1 e! e% d! q8 R: s. `; F    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

! M- F9 ?/ A5 n) v        #
" G& [2 M( O8 u3 E8 f; O& k2 X        # Om nom nom cookies
. O9 o( A7 c- \- s6 M2 a* y' k        #
        add_header 'Access-Control-Allow-Credentials' 'true';
9 O4 d) a9 F2 Y  |        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
/ ~* w; S8 D9 s- I8 a
        #
2 A2 ^7 f! b  \5 R# I! d! h        # Custom headers and headers various browsers *should* be OK with but aren't
, E8 p+ ]2 z( d! S3 l" j        #
, ^- u% a- D2 }/ m3 |        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

7 I# q8 J7 w5 A3 t* y+ Q: C        #
% k$ u- R# _) L2 B        # Tell client that this pre-flight info is valid for 20 days
        #
  H# Y& m# }8 I) |: v        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
( d, @9 j/ Z" s  n        add_header 'Content-Length' 0;
        return 204;
    }
5 I" _8 Q9 \: b, C0 d2 F
    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
% a0 I; q' E: u5 z, @1 x8 X        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

}

6 B* ^( B! [+ }- O( K& {/ s% N7 u
6 u, [& h  p9 l% b) p