Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
+ G$ h3 |3 J* {/ Z

: q3 f9 g) i0 M- Y  _- k

# CORS header support
#
$ N4 i: C7 |/ g9 {, P# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
#   include cors_support;
: F1 w1 O& `" O4 C* F: l' o#
0 P* T; o; ]: R# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
5 S; n# H' e" R4 S. e# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
- G9 V" C. W# {, _#
- Z' ?$ O! ]' i0 \2 k$ Y5 [1 _
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
7 p* z$ ?4 d4 P! c( r- J}
* U3 z7 Q6 h/ g) c1 T: B
5 J( p$ i  J8 B$ x8 lif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
3 I7 [& o6 k, q- v        add_header 'Access-Control-Allow-Credentials' 'true' always;
" ?9 |) h" _7 F3 j- Y" U+ }        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
/ P, t, D( X7 z1 \, u8 s$ Z4 J7 Q        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
! o% ~8 w  v8 P: h
if ($request_method = 'OPTIONS') {
3 U/ G, T8 n( t2 S( Q0 |6 v        # Tell client that this pre-flight info is valid for 20 days
/ L8 B" t; H* s4 O2 t. j  g4 B        add_header 'Access-Control-Max-Age' 1728000;
& o6 g0 q! i: Z8 w% y& ^- \        add_header 'Content-Type' 'text/plain charset=UTF-8';
4 P1 W9 h! A$ O! s* U1 w2 y        add_header 'Content-Length' 0;
, M5 @0 x% w1 M- r+ d: F  t6 A        return 204;
6 U$ F5 S- f6 g8 q}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
0 z2 [, W9 u6 v4 V' t! S

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
; Y  D! I& ~9 Y3 e* J}
set $origin $http_origin;
& g. F5 n1 S+ n, Bif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
/ V' D& v0 g0 P( h1 }. \     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
" v' Q, {( q8 @/ Q: n5 k; r  ]     add_header Content-Length 0;
9 C0 f$ l3 D% Z% H, |7 i     return 204;
}
& j: W/ \& v- W( j; Z. @5 Dif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
1 i; b8 m+ e: Z$ L  M2 H1 U     add_header Access-Control-Allow-Origin "$origin" always;
- X5 L# p$ |. U     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
$ _. Z7 s0 M5 G+ s6 C* I     add_header Access-Control-Allow-Credentials true always;
  q$ z5 m% q5 G9 V! ^}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
3 o3 H' z" Z& k* s#
5 j( n! }1 ]( T7 d2 w$ W# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
) U2 w% s* Y) L; ]+ |#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
* F5 J+ U+ d4 @9 W3 N( o& K+ q# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
; M! \6 m- O- P5 y4 l' d#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
  t, }4 x) i* u' z/ y$ j# method to control access instead.
#
( [- z4 \1 Q) o0 T# NB: This relies on the use of the 'Origin' HTTP Header.
5 _( n& `" l; I; Z* z
location / {

  j9 Z5 S6 q+ ~( M0 ]# i/ F, P    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
7 N3 s+ L  Q8 J9 T) @, p    }

- }3 a  g1 ]) c    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
- a8 h' x! o7 h    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
% u" p1 B% H. N) c0 W5 d    }
! H% c2 D) P3 \# T    if ($request_method = 'GET') {
& F+ M9 r# v& u        set $cors "${cors}get";
    }
0 T& Y0 J0 N! p    if ($request_method = 'POST') {
        set $cors "${cors}post";
% E9 g; j. H! t    }

8 {( w' r* o6 x2 P9 O+ @8 {& [    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
7 ^0 w1 t( X# Z+ g0 m! O" d        add_header 'Access-Control-Allow-Origin' "$http_origin";
, {$ Q2 B2 t  N    }
: b, _! s1 F1 f# t' F4 I
& i7 o; k" \+ M7 s! |+ {- w    if ($cors = "trueget") {
4 h! D8 X2 m4 O2 y+ Y        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
. Z7 ^5 q. i# J5 [  H        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
* g+ v3 Y7 c- `- `    }

8 e: B, P: k, c6 Y, H" q    if ($cors = "trueoptions") {
/ s8 O$ l2 u5 `2 D! s* _        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
& L- x! W+ b/ ~7 s/ ~& J        # Om nom nom cookies
; Z3 n1 q0 W! E! A$ b( ^        #
3 @" m' J5 e1 k( W        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
& K8 ]$ G& m  u9 X
# ]3 r  v1 k/ n- o5 }4 K        #
  m" p8 [# R' M4 P9 O2 w$ P8 X. R+ h4 E        # Custom headers and headers various browsers *should* be OK with but aren't
" E7 H0 e4 E3 a( @- z# U$ S        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+ Q3 s: t1 D7 C( N0 O9 K
        #
; i" G6 ~9 j$ C7 U        # Tell client that this pre-flight info is valid for 20 days
        #
% Q4 p' W7 `5 h; I, w# C( G& V! u0 W        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
" r9 X. r# K( N- n" V        add_header 'Content-Length' 0;
' G  t1 I0 }; |1 a6 z2 q        return 204;
9 Q: p0 R! N  q+ l9 Q( T    }

' w: B4 {( b1 x& A) O) R4 m) g    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
* D# G( \, ?& Z& g6 |# g        add_header 'Access-Control-Allow-Credentials' 'true';
! g# s$ _  Y4 g        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
# y! L% k: r5 [. K' ?" u$ ^/ }        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
1 L- g5 G. _7 e& V
}

$ V: V$ `8 `* s0 I0 C6 a8 \' Z! u$ t
7 k" T9 n. V2 B% P* p3 N