Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

1 F1 c- R2 L! y) }
/ J: P& y: T. a; @

# CORS header support
#
. V" \3 ~& ?% B, Z# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
  w. o$ m' D' w. \+ f! g6 N- a$ w6 g# statement inside your **location** block(s):
#
#   include cors_support;
#
8 O$ `# a& z7 \* W# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
$ |5 J, W9 T0 s7 `#
# For more information on CORS, please see: http://enable-cors.org/
7 c+ ~0 ?& n  d# y1 Q! C8 N# Forked from this Gist: https://gist.github.com/michiel/1064640
+ j7 G# h) J6 M2 }" S4 ]#
$ N+ T( a( }7 I
! Y1 t7 d  F* H9 V) Nset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
! q! e5 v) k* l- k: `: s% s        set $cors 'true';
6 y/ V4 v. O9 X0 ]  E}
7 r! {9 \1 ^+ e, g$ t! v
if ($cors = 'true') {
' D$ T  `9 g8 z        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
; s; t1 i  s0 [        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
$ ~. M, Z3 l* c! g: k        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
" S2 g! I5 A4 p8 `6 u5 _}
' u2 X  D/ u) w8 J$ c+ W/ w
8 k; ?0 g/ H: B8 h3 [4 F5 e3 Xif ($request_method = 'OPTIONS') {
- A1 e& w% B5 g- J1 s        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
6 a8 K* u4 n+ ~1 c# y! L8 v        return 204;
1 t% F, t# s" ]. i. Q$ W& d3 b}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
8 i5 N" l4 b' h/ Y+ J}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
$ Y3 @, i! `( _# Q     add_header 'Access-Control-Allow-Origin' "$origin" always;
5 P+ s: ?0 A6 X; ]/ w. W     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
( l3 g( M0 T+ Q5 I  Y5 @5 p- M     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
- v$ K/ d( S. a9 g8 E, h0 s     add_header 'Access-Control-Allow-Credentials' 'true' always;
* s. W3 U0 ]# W; V& B, S     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
5 B' n) H! \, m3 L     return 204;
. v; a( i7 B# e$ h6 A  ^' w}
5 |9 ?# n* P# z. s- e8 v& R, n# yif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
. j5 d+ [" r4 E/ a6 i9 |" q     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
0 O6 [0 X$ |  Y# e4 @7 k+ H: p# R# t}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
9 s- j* x# z; M#
# Slightly tighter CORS config for nginx
/ o  M; r' G; K  T" ~1 `1 F" Y#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
! t3 E' n! X8 ^. M4 F. r$ g# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
" {- L4 Q9 s* r. A6 b& Y# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.

: B& y" J- t) N& Olocation / {

- h) j+ N& Y" y3 m' ^: F: `    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
) Z: u  T7 C: n        set $cors "true";
. K5 j1 a: f1 F' S* B- Q& k; w8 q    }
; `& m6 _- r+ i
+ V' L2 K% i5 ~& v( a" u6 H    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
* d- a. U4 k7 M+ [9 w( t5 L0 w# \    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
' h7 ^) Z) t2 z+ U! X6 X* B        set $cors "${cors}options";
    }
! D$ G2 k0 z" g    if ($request_method = 'GET') {
" }4 I/ p/ t7 m, r        set $cors "${cors}get";
1 ^0 M# n$ o# U/ l% `5 T    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }

( @* H+ L2 ?. E! ]9 [, D    if ($cors = "true") {
/ }4 O" V- ~3 z- N' X        # Catch all incase there's a request method we're not dealing with properly
8 [4 m. f+ y  U; Q" c; \        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

+ P  u2 _% [2 O  n* ]/ i1 S) g    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
3 ^% m0 \  O) l; S& }        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

/ s2 g( T1 j5 B) f* c& e7 V        #
0 E. R  V: q4 g4 H, I2 M3 W3 w        # Om nom nom cookies
8 g" T* U/ f6 A$ }) \' q6 h        #
        add_header 'Access-Control-Allow-Credentials' 'true';
2 F- M' m# X% E' e0 \: ~3 P        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
; a+ a4 I) {5 I0 r+ q        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
; S) c& l, t) L+ z' w0 j& @+ [2 ^
        #
        # Tell client that this pre-flight info is valid for 20 days
        #
. f+ D3 v6 [! y        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
4 ?% i/ n7 c. `# \, N, `9 e$ v        return 204;
    }
7 `) [+ m% F0 @6 K
. x' X1 k! L/ ^; q0 K0 u, }    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
3 n# t7 P- \! N        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
; S* T- ~. q/ y: Y, P        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

' J/ p5 D7 W2 {  s" \" G' W}

; _/ \, U, i: k' Z' ^0 N3 [
' g6 N3 L$ s6 @4 V" l6 F3 N