Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

" ~% s) [  D- K$ [2 N

# CORS header support
#
# \" N2 ~( m8 ?2 K# One way to use this is by placing it into a file called "cors_support"
" P' T9 g& C0 N/ t, E0 E# under your Nginx configuration directory and placing the following
3 n: o3 n  f! _& W+ ^7 \4 ~: l# statement inside your **location** block(s):
# j( V4 {. T8 C! f7 ^' ^, w1 N1 k( z#
& R3 u- x- z  J& b#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
% V, X* M- P2 H" f" D+ O6 F# allows CORS to work if the backend returns 4xx or 5xx status code.
#
4 a1 l: o, m8 d8 Z, j$ R' E# For more information on CORS, please see: http://enable-cors.org/
8 r6 i/ T. p+ W# Forked from this Gist: https://gist.github.com/michiel/1064640
#
3 E: B% t4 J" T' q+ c" d
set $cors '';
+ n6 }" g" `! ^& c9 r- J. ^9 @if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
2 L' D7 E/ ~+ Y}
. @+ b1 z/ |% D* W5 W
# t3 B* ?5 o4 zif ($cors = 'true') {
6 o' x0 q/ w3 r5 n        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
  n2 @3 U  J( M$ ?        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
$ M0 i; m# q4 u# z        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
" J9 r$ v5 ?' b) t/ ]2 p        # required to be able to read Authorization header in frontend
* H* B0 A, }) o' a9 b" {        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
2 r9 B) q& [- }( R- O, o* z: m. A
1 w0 d+ C1 l/ ~6 W3 @' R" Tif ($request_method = 'OPTIONS') {
, m& l8 L8 M5 n% F6 ]        # Tell client that this pre-flight info is valid for 20 days
' }$ L: \9 F4 H% I+ R& \        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
  G- L# e6 \9 Y1 y5 h% `' J4 c        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
, h# |+ }1 T7 g

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
' t( n* ?% I% G0 D+ |5 jif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
! t: d2 D% o( W2 ^  f+ w& e" I) Vif ($request_method = 'OPTIONS') {
# V8 q6 }, \3 I0 d     add_header 'Access-Control-Allow-Origin' "$origin" always;
- }/ r/ W% ^- J     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
" Z: T  N: N9 D2 V$ F0 D     return 204;
% H% N# F- w; P7 P/ v6 S}
8 w0 w3 K6 o' j8 Iif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
2 v' p- z2 m. q9 h     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
& n+ v, q" p6 j* s' J/ v     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
$ _9 m3 _; l6 p. E0 B% P# Slightly tighter CORS config for nginx
' L5 m' w: |7 i% C1 M7 d/ C#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
* q; @0 b8 E5 i#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
, t1 F5 w+ Q% ]# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
5 c# ]8 R4 u; z) F9 {+ n, Z# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.
7 e9 k7 {+ S$ h
location / {
, f, x+ F0 D) M" b; V3 n7 E
8 ^* R: B7 H8 a" o  `5 {) l6 t    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
. K3 o- D# N# i* {! D        set $cors "true";
    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
' Y3 d* W8 K7 m    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
' b9 h' W4 S, u, K7 N+ d        set $cors "${cors}options";
6 R) G, Y8 B' X+ Q    }
    if ($request_method = 'GET') {
2 Y! [: U2 D! \- a        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
, c$ {7 x! m! D4 E( a) `9 r% J' b        set $cors "${cors}post";
0 _: B7 h9 w$ O- r# D  e    }

! C; }; Z* G/ z; v. M/ R: i5 T1 }    if ($cors = "true") {
2 o  P7 n- c2 j0 A        # Catch all incase there's a request method we're not dealing with properly
2 R' I) {2 z  I4 u        add_header 'Access-Control-Allow-Origin' "$http_origin";
' }/ `. u9 _" _3 V5 Z    }

    if ($cors = "trueget") {
7 N0 q/ o- ?5 o9 V        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+ r8 K6 a& Y- _5 C        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
) t( B9 _  O' B    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

: C) v! b( q9 |& Y# n4 T$ \        #
        # Om nom nom cookies
( d. i1 L1 {. [0 H4 G. X- D% M        #
1 s3 U; x6 X" Z0 I  ~( t1 S        add_header 'Access-Control-Allow-Credentials' 'true';
1 j% u. r0 |: G4 c( x        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
2 @( z  g6 i: ?8 f* N% J4 K        # Custom headers and headers various browsers *should* be OK with but aren't
3 J! _8 A9 z2 y7 x" o1 e' s/ R0 W2 i        #
  Y3 k4 d! {1 `  ^        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
& E/ K( ~# K! S1 S/ j
( Q/ w, f" T6 o        #
& Q* }$ x% n9 ]; j7 L5 T$ {        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
6 x7 B" E6 C$ n+ A; J$ C        add_header 'Content-Type' 'text/plain charset=UTF-8';
% a' u  |4 L. s6 I: _        add_header 'Content-Length' 0;
        return 204;
    }
% \5 |& a$ S$ D$ |8 v
: K+ I; R2 h: {1 O0 u3 h: \    if ($cors = "truepost") {
, f3 ~/ `5 R$ v9 s" }1 X" c6 p        add_header 'Access-Control-Allow-Origin' "$http_origin";
( ?$ u7 S5 K& a3 K        add_header 'Access-Control-Allow-Credentials' 'true';
/ Z, p: v, M! X6 g; t" a  ~        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
8 _. j5 \- r) [        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
* E; a  I2 \+ B( }
}