Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
, t, O& r, Q: j' |) e' m( f4 ]

3 {4 \  O/ t8 L6 d8 p: h

# CORS header support
; j+ h. X' l. r  o#
3 L+ H- P7 D* }7 A/ L0 `+ e# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
4 a: O7 Y* b0 o1 X; ^3 C- ]# statement inside your **location** block(s):
#
* p( R, `- B8 v3 o7 Q; ^#   include cors_support;
#
: r/ \1 k6 z. w! e1 l# As of Nginx 1.7.5, add_header supports an "always" parameter which
0 T# m& a, Q# t) D' n# allows CORS to work if the backend returns 4xx or 5xx status code.
#
- i/ h: {5 g! `8 Z+ \# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
% e$ C7 y* I* O" g* k% G#

3 s1 U. V  G) }3 y. eset $cors '';
0 p( A* F9 R, ~. t8 F8 c' p! H3 lif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
* c# O9 G4 s$ s/ x$ q$ p- V}
7 t; m/ c3 V3 S. g
6 K- P' Y+ J5 m. Y/ t5 \% S1 cif ($cors = 'true') {
1 \# }* M, y7 X  I* f4 Q+ h) k        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
4 t/ M8 k% E) Q0 p1 B2 q# Z% _        add_header 'Access-Control-Allow-Credentials' 'true' always;
9 v+ G% ~2 K& A9 Z( [* b' v6 o" H$ {        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
% q+ s) U; g4 j; ?1 D6 z9 r; T        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

8 _. ~# L# b: a5 P9 f. }1 uif ($request_method = 'OPTIONS') {
* z9 x6 A' ?# K/ r" y7 p, j' ^        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
  o* q5 y+ D+ r: ?% ?4 ^! ~; M) \        add_header 'Content-Length' 0;
        return 204;
$ w# f/ \: }' a0 _}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
( q  Z8 ~& \- _# M6 L# Y6 G" R

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
$ A- f! M6 _" d}
set $origin $http_origin;
4 ?: v8 s6 r) ~! Y: y9 \if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
4 [; ~8 D- d' x1 o) Lif ($request_method = 'OPTIONS') {
! \4 B2 S- c0 H4 R' z5 A1 M     add_header 'Access-Control-Allow-Origin' "$origin" always;
/ j7 g# ?5 K/ R' [     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
/ L4 @7 C$ d; u     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
4 U+ R8 v4 J) u5 h% ]     add_header 'Access-Control-Allow-Credentials' 'true' always;
$ s3 P: s8 o9 Z% S     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
7 m8 t9 O$ P( F. Z0 K: I8 e     return 204;
7 y$ B: f  F9 g3 F0 b}
8 ~8 k; u4 t9 H' l4 A, h( jif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
0 ^+ G: h. t1 }4 l     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
& d+ v. ]" u; r$ |" u     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
+ X  P7 K4 _! F& v% V: Q     add_header Access-Control-Allow-Credentials true always;
- T9 h3 N5 y' u9 I$ v6 t2 h8 N}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
% N. M& j$ B- W7 l& {4 v4 q# Slightly tighter CORS config for nginx
6 q9 Z1 b/ p/ i+ O#
  F$ l" X% p3 J7 [, L9 a1 Z4 N# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
' j3 ?6 O9 c& Z+ }* Y# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
7 l% H! N9 K, y& w- y! ?6 R/ p# don't seem to play nicely with this.
$ D1 O5 P; W, T#
' s/ I8 S: `! L: |# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
! j* b6 ], ~& }; y# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.

location / {
# L, o% i1 L( e0 V  I
7 p6 J; L0 d! O4 i    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
, c" H& @* V6 A/ H  s+ p- F: a        set $cors "true";
4 W6 y6 @) G$ L' U0 E- n    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
3 h$ D4 Y) l0 E2 w    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
: `; |9 S" [* T4 J. [/ e$ I        set $cors "${cors}options";
& ~" M; m) o8 q9 A    }
$ }& Y3 D" v6 y4 Y% N* q5 I, A    if ($request_method = 'GET') {
: b4 e8 ~5 W- N3 b7 E' C        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
6 J& [7 `( \- R$ r; M+ I" I        set $cors "${cors}post";
    }

, f& u& r! O- ~, W" u7 n3 J    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
9 x+ N/ e: r* o; M; a( s( O7 j" a        add_header 'Access-Control-Allow-Origin' "$http_origin";
9 u/ K8 _: V+ O    }
0 \; R) d0 z) F' m9 s4 j4 D
    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
! k1 F' W# ]# W) S+ H        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

/ ]5 D. q# q$ k    if ($cors = "trueoptions") {
; v. m" A9 n* U# g1 s4 `! l        add_header 'Access-Control-Allow-Origin' "$http_origin";
* e/ I* J( J) W' e
        #
        # Om nom nom cookies
5 P" f& N" C1 ?1 v  \        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
, p3 {! s6 N" Y0 z# e        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
9 B9 y# J5 C% k# D4 s5 j, o
        #
2 L! q' P2 }# q+ O        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
    }

' [4 F$ C4 j  k5 e8 G    if ($cors = "truepost") {
6 }5 W2 B& s) m8 ~1 Q; m        add_header 'Access-Control-Allow-Origin' "$http_origin";
1 `/ \' V' q$ ~$ @& w( }# H& Q0 m        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
, \/ C. b6 C4 |& ~( |7 N% _        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

}