Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

: i  S: f+ C0 q! |! x! e

# CORS header support
' W" E9 W" k0 o# w' t/ Z#
# One way to use this is by placing it into a file called "cors_support"
/ r1 q7 M9 i0 m) E. L1 d# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
#   include cors_support;
3 y* h, \6 J  H: W+ ^8 J% m% I, G#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
% [9 k7 x3 n5 r# allows CORS to work if the backend returns 4xx or 5xx status code.
, ^0 _2 @2 J# M5 \#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
* \3 R) ?, z7 z+ a0 Y9 W
/ s- r7 u0 {4 U7 x/ Q6 I  tset $cors '';
3 c6 j: g; k/ q# I6 k, G+ {if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
}
+ d& f) {% V: i8 {# z# I' z
if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
4 M) I7 N" O2 e7 b1 Y" _        add_header 'Access-Control-Allow-Credentials' 'true' always;
4 v6 k" ]4 i0 i        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
# b# s% J, ~" j5 ^# P        # required to be able to read Authorization header in frontend
* M' m: k- f0 R, k  I        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
+ {8 d  u) h' _- `1 h}
; R/ W" m: \6 R) n5 T
. d% B( l7 c  a1 _) {' f; H- _if ($request_method = 'OPTIONS') {
0 r' y9 s  @8 W1 X        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
( F2 Q1 \5 V* F. q        add_header 'Content-Type' 'text/plain charset=UTF-8';
0 Y3 k( K+ ~! ?6 S, \" L9 r5 w        add_header 'Content-Length' 0;
. g( Z0 o" Q' ]! ^- t3 J        return 204;
& {( G' o" I6 q& `. S% H& Q' Q}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
, I. q3 A) z7 e7 v}
3 q5 O  j5 S& n- f: {  [4 hset $origin $http_origin;
' x* \; x9 d6 k# mif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
/ V7 M$ W  a( P* l9 _3 M: c6 u}
if ($request_method = 'OPTIONS') {
, l$ D9 G1 b3 t0 \9 Y  l     add_header 'Access-Control-Allow-Origin' "$origin" always;
5 b2 d5 N0 N9 }3 C     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
# t; F* C3 Q- h/ s( B$ _     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
4 W: Y" Y% c& l: r$ c; ^0 A  k     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
$ |0 P- ^/ }3 l1 ?  M0 @5 A}
- D! G  n6 A- N3 g  Yif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
5 e5 S5 p- C' Q& h" I     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
, T* d+ i' B& `     add_header Access-Control-Allow-Credentials true always;
) v0 s4 y' r. O}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
3 @( u& ?' ~& y2 i% P3 ~8 o! \, ]# Slightly tighter CORS config for nginx
( I" V0 O: ]6 V: h0 W9 Y#
; F: b# q! V" d! Z% O0 P# v# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
/ J$ p6 K3 z, p2 m( l#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
" M) r+ i$ }% c/ ?# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
, b7 c5 o. }6 z" |" N#
/ W! I8 K/ q' N: @# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.

* M3 d# {8 T7 ?: l5 clocation / {
1 E9 s  E& _. i, b3 n* Y
3 N$ x7 e+ y6 |: P" Y. d8 J    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
' J. D' A9 h  g6 C% c' m9 d        set $cors "true";
/ P% R7 U) e. ^1 T0 v    }
! _9 L2 {% j4 ?1 l) m: h
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
8 c' r; ^, Z( C2 Q7 f- c3 \2 |    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
! W4 R4 G! g3 Z3 ~' C    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }

    if ($cors = "true") {
! n5 f7 }7 B; O3 G# j. p        # Catch all incase there's a request method we're not dealing with properly
2 @( m) t, l4 A  k2 a/ o: C1 }' {$ r        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

6 M9 @! q; w% `# X/ f+ Z    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
. S7 n9 ~5 }' u, y2 h* i, e0 X    }

1 y. c) r1 `0 A' r    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
$ A- g/ ~* P4 T! s- U" }3 A        # Om nom nom cookies
- g, c& }8 a: E  s* H: [6 n        #
        add_header 'Access-Control-Allow-Credentials' 'true';
, X* ^# z8 y) e$ A/ _) p. `8 @$ O: v        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+ E# k) t7 s3 \4 a
3 H5 J" N% ?9 Z  J! o. L        #
+ ^' g1 ]5 i; w7 X        # Custom headers and headers various browsers *should* be OK with but aren't
        #
; R9 n& b  k/ k- p        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
; f& v% X! b5 }( P% r+ W: H
        #
        # Tell client that this pre-flight info is valid for 20 days
- x. }2 p% }! F" N1 G5 t8 N        #
! d* e8 S# E3 s1 a  q0 X        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
) ~8 A# V' u8 y" E* g( }* \. J        add_header 'Content-Length' 0;
        return 204;
7 r. r. [$ t! O    }
% k$ p$ S  B* ^2 ~: T$ M( C
$ |9 u' g. G1 Q* K% w! \( X    if ($cors = "truepost") {
# ]+ h4 w8 R; o: E" \0 R4 s6 v, z        add_header 'Access-Control-Allow-Origin' "$http_origin";
9 a: Y; m5 B( ^/ H/ z        add_header 'Access-Control-Allow-Credentials' 'true';
. s$ S; n8 O" Z% ?. m' O. j# l        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
; \2 {& i. }% K  _8 m" w        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
# J  B# C- B' S# X$ a) V
4 d0 Q6 {6 W. J; \}

/ p" P; C9 P6 _% D6 @/ E6 n' D