Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
: U7 H7 C0 B6 O/ b! w2 f

: [5 L# Z6 @% w- V0 D1 F

# CORS header support
% G# a% n' D6 z) @#
7 Q% S! W% n' b7 i/ U; R& y# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
2 H3 V' E8 n! [- V/ R# statement inside your **location** block(s):
2 B( k" \, K; I: S7 B1 W2 }' i4 Z#
#   include cors_support;
# J% F# o0 x8 x  I' H#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
3 e4 I8 U6 e( v% _#
3 B& P: O' o: I$ p0 L; n: a4 s# For more information on CORS, please see: http://enable-cors.org/
1 V' S# \% m5 y' C6 [( g4 |# Forked from this Gist: https://gist.github.com/michiel/1064640
% H2 q4 Y% n  c/ o  Y- e/ }) b#

set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
3 U4 t! B- v; Q( r- v        set $cors 'true';
' ?/ Q1 D& R* @4 M7 g}

if ($cors = 'true') {
/ o; W- ^" t( v$ O# D! c! F$ ~        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
+ u- F6 o. M# k8 ^) v        add_header 'Access-Control-Allow-Credentials' 'true' always;
8 n* g4 w; Q' t7 N; Q% n        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
, w) y3 X6 L1 m7 E4 k' ]        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
3 I6 X$ J  B, X        # required to be able to read Authorization header in frontend
. S: L8 d2 I* c# G& M        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

( Y$ j' A/ y+ z9 I+ Eif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
. @4 U" H2 [3 ?9 E        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
* \! O9 O7 E- {% `  G, c        add_header 'Content-Length' 0;
8 b. m, j9 ^. `        return 204;
+ @. _1 m5 b! x5 O- q}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
% m3 i& P4 N) j2 Z. y6 `  q}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
4 U8 H9 x/ D: ~: I' n}
if ($request_method = 'OPTIONS') {
, s+ ]3 X5 C, T1 H( r2 |     add_header 'Access-Control-Allow-Origin' "$origin" always;
+ Z- P$ {; A- O5 X     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
% b* ~  f! z& h0 l     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
% h1 v, y& a2 y; Y, O- w; m     add_header Content-Type 'text/plain charset=UTF-8';
! n! ~7 E* V* v# o& g     add_header Content-Length 0;
     return 204;
}
7 ]+ f% Y( b9 Q, Rif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
; q) }0 w! k2 L! B, u' _     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
( M. X9 f) c3 R$ e) \. O#
# Slightly tighter CORS config for nginx
#
% M- X6 O1 F* I4 `1 i( \# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
$ u, u' H2 o: ]# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
1 W$ [/ A' c2 f8 m6 G0 L# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
( T% u) h) l* u+ `#
3 [. }* l3 `) [5 U' q8 H# s# NB: This relies on the use of the 'Origin' HTTP Header.

: o! C) F- o' O. g9 wlocation / {
5 u6 y# R3 s) H- `7 j8 J8 C
6 z3 U0 x, E7 M8 c, q    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
8 U+ K, h  _, I6 A* a) [5 m    }
; H/ ~( r4 _& W* n- N
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
% x0 F8 ~- }$ V9 f    # Determine the HTTP request method used
% S/ V2 A) M' B' u8 O. z5 }# {    if ($request_method = 'OPTIONS') {
; q6 ^2 Q* Q5 ~& {" @        set $cors "${cors}options";
$ t4 b) E) [+ q7 f    }
# l6 h- d$ |7 B, R) M    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
6 a7 }' T  ?  M3 Z6 c9 s/ \/ c    if ($request_method = 'POST') {
3 p8 A, ~2 C$ U. r* I5 k4 G        set $cors "${cors}post";
    }

    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
# p$ E4 ^" Q! P) C7 h# y2 b        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
! ?/ ^' P( b& ^0 u" s- V* h1 Y$ C
    if ($cors = "trueget") {
+ K0 u- B" I2 m& ^6 W6 ^        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
0 \- Q0 M' o; ^8 ^, U/ R        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
  D2 Z! I9 R: {3 f    }
0 t7 r/ {$ T% ?, V- a# C9 s8 j
    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
7 {6 v7 n% H, n. t! G
        #
        # Om nom nom cookies
2 J  c7 O( ]1 c* w& g, k' \        #
6 A$ w+ d3 k; U0 Q7 d( h        add_header 'Access-Control-Allow-Credentials' 'true';
; ?2 g1 [5 U9 o5 `0 k, e        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

. z5 s, h3 h8 ~) z- _1 m7 V        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
3 \" E! V' s/ A$ N
- s4 R% T- B+ |: x# c9 k$ y        #
! O5 h  o1 p/ I7 r* U" `        # Tell client that this pre-flight info is valid for 20 days
" Y% u' P/ d" c7 U& U        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
' N/ n. P* b, q        add_header 'Content-Length' 0;
/ x( |( ^! g6 F5 M        return 204;
    }

1 \- l1 \% Z. \0 v- b& n/ P  B+ E4 ?    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

}

3 x5 |' l/ H: N  a