Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

# CORS header support
#
& y9 D" v% h. a! }# One way to use this is by placing it into a file called "cors_support"
$ o& `% K- p4 x; l& k3 L) E. T' q# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
& c' w+ c2 U* S2 b#
" @; T# g7 A5 q3 {) j' Y#   include cors_support;
: @5 B" \' H% q6 I6 a#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# A, J5 O. ~2 t+ `1 Q# allows CORS to work if the backend returns 4xx or 5xx status code.
  e$ i9 n8 u! ?4 v7 f6 q) Z#
" V, G6 {9 ]( Y% v/ f/ E& S9 _# For more information on CORS, please see: http://enable-cors.org/
) A5 t0 B1 E* W# Forked from this Gist: https://gist.github.com/michiel/1064640
#
7 A/ A1 k# N+ t8 E
! I9 |: v1 K0 {* t9 x: G% X( Y/ hset $cors '';
' N! |& c3 B1 q) I; sif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
2 j0 [: W. j2 T' A: T        set $cors 'true';
}

if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
1 U0 ]' r2 A, i8 G        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
; Y% _" R" D" L% c        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
  D$ Z5 n/ Z: L  q3 X* @& w        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
! a7 x, c& n. {2 Z' @  n# ]}
5 n- }2 P- q' k. Z
! F4 }9 B5 V1 F8 ]/ Kif ($request_method = 'OPTIONS') {
/ O4 U( k6 C2 d        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
8 H; K/ Y6 w9 @! e. [        add_header 'Content-Length' 0;
        return 204;
  _- n- r9 K8 n* `. f}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
  s' z6 l3 R6 D8 S+ J

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
% w; N3 L8 b9 |& ^' ^if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
1 f; s; i% f5 A* T* |# e6 U9 z& Bif ($request_method = 'OPTIONS') {
9 Z% f* s6 @0 T0 m7 O, Q3 a2 Y     add_header 'Access-Control-Allow-Origin' "$origin" always;
/ n! \: D2 Y2 u0 p; g     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
% S- f5 R' X* [- L8 R     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
- {( R7 r: B. k. h, H. r) O     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
; U) x/ q( i/ {4 A! C, V( J+ ?     add_header Content-Length 0;
     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
7 K" E. i( a' @9 f5 l- M8 C, G     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
1 g9 ^* W  D1 L' ^' s$ T# Slightly tighter CORS config for nginx
* a5 A, L( B2 I! t4 I- I' }5 s#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
  Q" t2 b7 W- A+ Z* d  O# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
! O# S- l. \8 V7 w4 ~, B# W# don't seem to play nicely with this.
#
: W" S- l  O4 {5 h, A# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
9 j0 {! j6 I& k' {! S/ E/ G0 c  X# method to control access instead.
#
% m  V# X0 t# o* }# NB: This relies on the use of the 'Origin' HTTP Header.
3 k7 _* w. [4 H3 k
) F& ]0 F) C( o9 t& }6 o) |# Plocation / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
6 q; y' M4 ^6 b0 y; a) m' W& q  @        set $cors "true";
8 M* ]2 U/ j  ?" q7 [- I4 [! K# w+ Y    }
! v9 s! R3 m& d7 o0 C/ |
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
1 ]( M# x, m- u) {! u2 e) _    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
. p4 P$ x& _9 S3 \7 v        set $cors "${cors}options";
    }
" ?8 A& Q: i% \( s, r1 r( ?- _    if ($request_method = 'GET') {
. o+ c$ I6 C0 r2 S* G        set $cors "${cors}get";
    }
1 d& d2 g* ^0 S! T: Q5 |' d5 q/ M    if ($request_method = 'POST') {
        set $cors "${cors}post";
9 g* ^- s/ y) [" A( M. p1 i+ J& u    }

    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
- J! }* k1 n, M' |    }

    if ($cors = "trueget") {
  B' [: `( C' {! \5 C' f7 C/ t        add_header 'Access-Control-Allow-Origin' "$http_origin";
# L! T! D) a- S/ q% }* i2 W        add_header 'Access-Control-Allow-Credentials' 'true';
% M6 J& P( @7 @3 H9 g2 O        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
! T9 G+ L" J8 V5 [$ J9 E
    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
$ T. U4 \2 a+ e3 N. z4 ?
6 Q. M# \7 Q1 k        #
        # Om nom nom cookies
; X$ N8 M: d0 f2 ^, J3 K  A        #
# ~  _0 |8 G6 h        add_header 'Access-Control-Allow-Credentials' 'true';
$ S# ?7 S1 @4 |! R! o: d        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
$ k8 R7 C- \7 V( t9 F4 r
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
( K6 ?( d5 T+ Y8 x4 h        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
3 q# Z& T) M. {4 `  N- J
        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
    }

    if ($cors = "truepost") {
8 ]$ \7 j: @0 `& [$ A9 L        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
; X# K. [# g8 C7 A; _! i1 B        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
  e2 i- r" T# ^6 f    }

}

8 Z6 X7 `; P+ e6 k& ?
+ {+ X5 {1 y/ E1 B3 P) m  r, b