Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
1 G8 @) `6 y4 X

7 _) Z6 \: n2 r9 l

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
$ i. d; A3 K0 `* T9 v4 L* k# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
) ?0 s+ ?4 d- G( _$ l#   include cors_support;
5 E9 Y3 ]; s0 v2 E#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
3 G. B6 l' w, P, ]4 q/ ^1 ]# ~+ Y0 J. u# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
. f' s  k! L: m, d$ ~1 @* a# Forked from this Gist: https://gist.github.com/michiel/1064640
9 x8 u( E3 \* X. ^' M2 S#

4 e" ~: F: X' c0 V9 z0 g: k' u( u% V9 Wset $cors '';
, G: C+ N8 ?$ i: L8 J% Nif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
}

1 u- o( v$ h; n! x: o$ f; ^if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
, J) p& c1 f$ f$ E, B: {: w        add_header 'Access-Control-Allow-Credentials' 'true' always;
1 E4 _1 r! M- A; f5 m! }; N$ n        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
6 z, N# C5 e( _2 L& E. ?5 Q6 ]7 ?        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
; C& o. V+ @% T7 D3 K}

, R8 Q8 v. {1 ~6 c5 w6 Iif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
, L& |3 S6 a# `, K  B: ?        add_header 'Access-Control-Max-Age' 1728000;
4 J' e. S/ [; @- F/ y        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
/ S, z" ~; Z. V& x        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
# l3 O3 E2 @4 F: Q5 W: W

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
) a8 c4 R; z6 p3 sif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
% _5 j, n* ]: {, }( K' Z  e* Y}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
) `, W- ]" \# p' N, K' [/ E7 N     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
) T1 f8 X8 t4 S  G" F     add_header 'Access-Control-Allow-Credentials' 'true' always;
- E2 z3 W$ F) y, b     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
4 b1 u5 x2 I; }: x3 R     add_header Content-Length 0;
     return 204;
# U& u9 ?5 ~$ a}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
0 r3 Z: `- V) i5 ^% L     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
) j" S3 i8 v1 ~- I/ h, E+ _" u#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
; H. A1 ^( Z; I5 [+ V#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
1 p& ]: _' K! r& t' N& \# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
$ v5 l4 V3 s4 _  t+ u9 f( u8 Q# don't seem to play nicely with this.
, H- X# g+ d0 b9 y# U#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
3 k7 r$ J- B; S#
# NB: This relies on the use of the 'Origin' HTTP Header.
' U& Q+ b' S" Y# _+ q
' U# c- T$ n) i8 Rlocation / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
5 S' g( _9 [: ?; R7 ]6 P$ U    }
& n- i( z. L1 _, _: _- l2 [
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
6 A6 {; R6 S0 f" t( B    # Determine the HTTP request method used
2 b+ v% z- K# q) N, ~1 D    if ($request_method = 'OPTIONS') {
/ u  N2 R4 L) N        set $cors "${cors}options";
6 h1 k: T: ]. T& D: Y7 E* W& z    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
( [0 Q& M- v9 i% o    }
+ O# V- i! C4 \  I; [4 j    if ($request_method = 'POST') {
4 }& q1 b% w9 p: m        set $cors "${cors}post";
    }
& y- j+ N2 S% o
: {: i& [# o* e+ G1 r    if ($cors = "true") {
& ^" b; c9 h: Q1 m" _" M7 V; X4 g        # Catch all incase there's a request method we're not dealing with properly
. b) P3 K( e  D3 ^( }6 f! E        add_header 'Access-Control-Allow-Origin' "$http_origin";
1 X; i" ?1 c7 f0 E6 n    }
! I( \7 P" y6 z% h' G: p6 J4 x# n
: c3 t* O' {7 X: U  ~8 u    if ($cors = "trueget") {
% O9 l" K- B' i+ v- A' h" D        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
, V: T1 |) ?+ J9 s" T' i, n. X/ X. c
    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
0 N( Z; M  L" r3 ?
, h4 a4 m1 Y6 \9 C" H1 e( S8 I/ Q        #
        # Om nom nom cookies
$ F% g* r, R' B+ \' u& B6 X5 ~! U; n$ N        #
        add_header 'Access-Control-Allow-Credentials' 'true';
; C4 i  V! S! R8 \  f# b/ r7 ?        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
6 ~* ]8 S: P) Y; u. I( C' [
        #
$ o; X% l) E$ I        # Custom headers and headers various browsers *should* be OK with but aren't
2 Z8 p; J" a- ^! T/ {, k        #
, {! `6 q6 _# ~+ N$ e        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

  `% r/ ~% o' i  ?. A        #
& L& u9 ~! y3 c5 z% H# N        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
' {. a6 g- D1 z        add_header 'Content-Length' 0;
        return 204;
    }
4 V9 `4 A. |; Y& h4 L# }
" g0 C  a/ w' X  S9 Y    if ($cors = "truepost") {
" U1 G/ Q* M$ Q0 A& b2 n* m        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
- O9 W: o' s2 Z4 E        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
" _) |& J9 Y+ S+ i  e0 l1 d: |( {/ i6 T
}

- D  h; e7 A4 Q; n