Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:


2 v: W$ C) v" ^3 D0 V% K3 V

# CORS header support
4 x- v  H3 f! I( s; V# T: p#
0 X- X3 m! h8 H4 y0 E6 E4 H9 y# One way to use this is by placing it into a file called "cors_support"
2 o+ a2 K$ ^: H6 t# under your Nginx configuration directory and placing the following
7 m- i. |( s9 ^# statement inside your **location** block(s):
9 a" i; Q+ p7 ^$ R#
" N3 w6 G3 t8 t: K#   include cors_support;
8 A! {; b* y$ }& _& m! D# t#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
) X% c1 e/ _# G; @. ]: U7 Q# Forked from this Gist: https://gist.github.com/michiel/1064640
#

* S1 b: P+ F( \1 Iset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
}

3 }4 }$ R* i. y. V/ [$ p" Cif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
4 R2 S/ ~$ ^9 Z, T. n# w( c        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
. z$ P2 i9 n# M1 b2 e6 p, G        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
9 _$ R3 M2 J0 s' N' v}

if ($request_method = 'OPTIONS') {
2 f& G" x/ d$ |9 e. A( E        # Tell client that this pre-flight info is valid for 20 days
8 ]  Z2 k8 T7 Z  \) Z" X8 x        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
" Y4 W4 e( {" w& t        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
* B2 P1 e7 s# b& e  |# F3 K& C

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
6 x0 W: i! i1 J/ A% W) f0 Rset $origin $http_origin;
  ]0 T6 v7 }8 K) eif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
  y. E& @: L& f. G' M( U     add_header 'Access-Control-Allow-Origin' "$origin" always;
! c$ S( P8 m0 {; P2 ~     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
& n& C( v  \2 E( G: k     add_header 'Access-Control-Allow-Credentials' 'true' always;
, Y( [( c& _: s     add_header Access-Control-Max-Age 1728000;   #20 days   
4 E9 u* ~" ~& S7 r     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
/ z# W5 E0 y6 `7 n4 E! O5 B, ]3 z7 q     return 204;
3 m; e" ]+ J! e  z5 Q% \% \}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
0 D( l, E+ W" c: i% y* A' S5 ^     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
6 r* q1 }+ }& X% ]) \     add_header Access-Control-Allow-Credentials true always;
6 J, F9 Y2 l0 V2 F, i; t}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
& e( Q  v7 l0 S1 ^- Q# J( t" ?#
# Slightly tighter CORS config for nginx
$ M+ M& s$ Y# _6 P+ f0 P* Y: d1 b#
- O" [! P* x1 l3 S1 {# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
( @- |& d! o* s" |7 W# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
  @7 F# |- p  z* M* R$ J0 H6 k# don't seem to play nicely with this.
/ V3 u0 `) ]5 R) c5 U, j- ]! j  ~( U#
! D" i2 J6 N6 ?# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
1 @7 F, t5 c) f+ i# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.

+ I) i$ B7 h4 d1 w6 E1 x. hlocation / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
4 }; N4 I3 t: U/ V$ n3 i/ Z
" W1 _6 t& f4 ~( x8 Q    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
- H' U; D  d. N    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
* R9 Z+ b& h8 e: B- _    if ($request_method = 'GET') {
        set $cors "${cors}get";
& Y3 }! ~. P- x9 V* N    }
    if ($request_method = 'POST') {
# Y% k+ W& c6 x1 m8 r0 X        set $cors "${cors}post";
    }
, p, F; X$ A  E8 y2 H4 w7 o9 W
3 d- P! G& _0 `    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
- ?( k; r* q& q$ r- G        add_header 'Access-Control-Allow-Origin' "$http_origin";
$ M1 T3 v; U* U    }

1 t! U$ O# f; P: T) e    if ($cors = "trueget") {
: w' {# z6 |6 Z( ^+ o9 z8 F2 ?* d        add_header 'Access-Control-Allow-Origin' "$http_origin";
3 I7 z% a- t) m' L" q        add_header 'Access-Control-Allow-Credentials' 'true';
* }1 i& w& C/ D6 ]/ @( M: Y7 j        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
, b2 p* v: C4 i7 P* u        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

1 Z2 n; p4 u9 \7 k    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
. o9 X! G/ g$ P- a- G' r5 Y
        #
3 s  _3 G/ K6 d% Y3 H& M3 E/ h        # Om nom nom cookies
        #
9 L* U* B+ ]  r/ O2 v" ]  x2 l- _        add_header 'Access-Control-Allow-Credentials' 'true';
$ o4 B8 V' r" i' ]8 q+ ^        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
# k7 H+ a7 z2 m- h9 a% w; z$ I; {
        #
, o- d7 @6 h* u: X* c3 q$ |! b        # Custom headers and headers various browsers *should* be OK with but aren't
        #
% {" U0 k9 k$ C. v. D' c        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
        #
: b! v/ v7 d( b5 J- J2 A        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
- _0 E1 c2 K; c  t& K    }

# P( M3 C3 o* E( `    if ($cors = "truepost") {
. Z/ K$ l5 e9 X- @' p. x& W5 s        add_header 'Access-Control-Allow-Origin' "$http_origin";
0 q" R( e- W- a! _' K* s$ [7 b        add_header 'Access-Control-Allow-Credentials' 'true';
3 h+ Q1 A4 [& Y- F$ E+ }; k7 |/ k% D        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
# ?) f, `; {% k- j! V        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
/ o/ R$ {/ D" O/ k8 {
}

$ M$ E7 X" m7 L