Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

# CORS header support
5 e# J  j* _6 k% z/ Y( Z6 E" D#
# One way to use this is by placing it into a file called "cors_support"
) X& }! Y" U5 y# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
% Y9 R7 Y$ Y6 X5 D7 @* G# @* T8 L#
/ X' J3 e8 [3 @/ |& D0 I5 e#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
2 |" L, \8 I9 X( f2 t6 Y#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
) l4 }+ X5 g( T4 g+ }2 {#

' N1 O# m. a( P5 `' Dset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
}
0 T% f8 Y: m8 k# Y
if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
, b% h2 I( r8 O7 Y" a" q0 g        add_header 'Access-Control-Allow-Credentials' 'true' always;
/ s- g" ]* p; r& I: U        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
; W! [" ~: a- Y  r) s* o. _2 x        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
7 T$ K8 x: G* r5 F( K9 m* \; P}

if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
( [- y7 G4 T8 L' j: I; W% R2 s) @}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
. Q5 n0 b: f" E& `

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
, x8 I1 e) H$ f; nset $origin $http_origin;
& S( ]" C/ x! R- Vif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
8 A. G- Q$ M" W' l0 V6 I2 j     set $origin 'https://default.yourdom.zone';
}
3 |' B. L, @, L$ j3 q* t. uif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
# {+ z$ U3 A/ Y4 U     add_header 'Access-Control-Allow-Credentials' 'true' always;
6 f( c) K; {) R; t( ~% o     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
( ?& `$ [9 f4 ^3 K9 o! Y}
6 X5 n! Q/ `; N" a8 e) v" Cif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
* I. X$ V$ D( x) _* p4 j8 V     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
. o2 C" u6 D  B4 S& o     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
9 j1 u( v1 B/ O& ]( a% U* O}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
2 e" K/ b7 Z4 e6 D' s# ]8 R+ y" k1 U#
# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
, G& D! a; q( e. x% I3 Z/ i#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
3 @$ M* i1 P+ E  m6 m# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
: S" }- _- V* G: w7 Z#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
/ H$ a9 \3 `; [! `: f#
, r# K+ \/ }! m/ P$ V# NB: This relies on the use of the 'Origin' HTTP Header.

3 W( s( ?' i+ }  F& F0 z: Ulocation / {
& l* ~2 u3 u+ C: G" `" O, C5 t
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
' j' w% g# M& `8 d4 f        set $cors "true";
  v: R" n" w& p1 [6 N4 K6 T' k4 @    }
# P: n5 A2 ]; p6 h4 R/ ]
, l1 j5 E8 V7 p: Q    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
9 v9 x2 }" n3 J# Q# l3 M' i( D    if ($request_method = 'OPTIONS') {
0 \" _- ?" d0 g- B$ e# r        set $cors "${cors}options";
    }
% b# P# \4 J* X4 {! N6 v/ X) h    if ($request_method = 'GET') {
: k" A  g5 B; Z        set $cors "${cors}get";
0 d& ]+ P/ n& w# P' f( q. I9 M) d    }
# ?% ?' S7 W3 ^( z    if ($request_method = 'POST') {
$ B* W( M5 _' e$ r        set $cors "${cors}post";
: q3 ]# J  G1 F$ e1 o    }

    if ($cors = "true") {
$ I' B5 ~5 E: Z" H        # Catch all incase there's a request method we're not dealing with properly
! c. Y' [  v' i/ r4 h2 i: S        add_header 'Access-Control-Allow-Origin' "$http_origin";
6 J! s9 w( j& `    }
+ t, m( Q# H) l, F( Z0 Q
; `8 J+ f$ c4 g9 K/ ^9 S    if ($cors = "trueget") {
5 a: S$ W9 o+ X0 m+ f1 m* @  |: D        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
4 F- A$ f2 s2 z0 `% w        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
" q  c: C3 _. m* Y) ~        # Om nom nom cookies
/ }0 Z) h0 T1 r& T1 g% f, l- K        #
5 q" o; W& ]* \" n+ \        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
        # Custom headers and headers various browsers *should* be OK with but aren't
( I0 E6 v6 j( ?7 \, |        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
" }2 D# q: b  ?* L6 \. N
        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
6 T) G% g% ]9 U# ~& J( J        add_header 'Content-Type' 'text/plain charset=UTF-8';
" ~7 h) }1 u, C* ?  O: p/ I        add_header 'Content-Length' 0;
& A$ S  P* f/ E! J& Q/ R2 T5 i# k/ S        return 204;
    }

    if ($cors = "truepost") {
. Z) B/ c. B8 N! G1 X3 m* i; s        add_header 'Access-Control-Allow-Origin' "$http_origin";
: `% T5 Y, p8 _8 f' Q: ~2 M) \        add_header 'Access-Control-Allow-Credentials' 'true';
- _$ l: Z7 ?# A* _  ~6 t9 v3 `        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+ }3 P! l1 z: N/ O" s  E. j9 s        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+ O% q6 p0 a5 N% k    }

}

1 |1 x- ^) ~) m
+ w3 Z( z  P+ R$ a