Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

- v2 s; }6 ?* g' Y8 C: X6 z# X4 c

# CORS header support
+ S$ x8 z, l0 [0 V' u' i#
# One way to use this is by placing it into a file called "cors_support"
- v+ A5 p6 L6 u" _4 k( b# under your Nginx configuration directory and placing the following
" A" I, a% v: g; X# ~+ P5 y# statement inside your **location** block(s):
#
#   include cors_support;
8 j6 j+ f- [' x#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
/ i+ |* s) |5 ]( ]/ Q! A$ Q# allows CORS to work if the backend returns 4xx or 5xx status code.
#
5 H( I4 B0 F. V# For more information on CORS, please see: http://enable-cors.org/
: F+ m0 s  }3 w, O: o# Forked from this Gist: https://gist.github.com/michiel/1064640
. V: t  r: G4 y2 t) s5 p& Q#
! ^" V; k9 x: G& K
set $cors '';
! D. ^8 w$ ]0 z+ F! n5 kif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
) _) O* ?* X% ?9 q9 x+ l8 B8 v/ }) T        set $cors 'true';
4 X7 N2 h8 x8 O$ o+ g3 I}

9 R4 D4 U0 g( K& a" h( `# y. Eif ($cors = 'true') {
# I' f+ a: K3 i9 I$ D; M  H, j- D" {        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
2 T- P0 O1 S9 u4 E# J5 C+ K. X        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
  U3 {, d( Q/ N" O# S* f8 i        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
; M( k% e1 n( x5 {, a) v
if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
- u3 H  a5 _$ ^7 \        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
$ `9 A0 q, k  Q8 g" f( F- S}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
( K- @- R/ [# v9 c

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
: R( _! t1 j) a1 M$ k     set $origin 'https://default.yourdom.zone';
& X" \" b& A4 l4 R6 e" R0 q3 R+ N3 j, r}
+ l* ?! n" E1 s6 @$ Eif ($request_method = 'OPTIONS') {
: I: o; l) x; ]" I, f6 i/ S     add_header 'Access-Control-Allow-Origin' "$origin" always;
6 R/ ^, Y9 b3 \8 v( ]     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
6 r, D6 S, d. A7 {1 Y* C     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
: `; Y6 f2 H  K5 j     add_header 'Access-Control-Allow-Credentials' 'true' always;
) _% k4 q1 D3 T4 [) E; e! Y     add_header Access-Control-Max-Age 1728000;   #20 days   
* d: Y* T4 [, H6 h2 c* |8 g. _     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
+ V& p7 D( V; T1 z6 |}
" z% V- {) Q6 q1 A3 _if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
" ]6 ?1 T  F2 j% Q     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
) h9 a/ r% e4 O: t4 U* }#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
% G+ h0 P! w/ x6 I$ _#
1 r, |" I8 B) T# J( D7 x# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
/ R* u& z! J8 l+ i" Q# don't seem to play nicely with this.
#
8 F/ a. f" K. H0 k  R, K$ i# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
$ X1 l+ O! y! `6 ?2 {6 _# NB: This relies on the use of the 'Origin' HTTP Header.

' b/ d+ ^% i" ?location / {
+ `1 A9 s: Y0 }% g) Y/ v9 H% N+ V$ G
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
2 V' `' R" e- F: q) x
0 ^9 b, l: f- y9 y& Q- p$ {    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
* }2 n! V  k7 `5 o( }; n: F. H5 C        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
! t  H- _/ G1 m4 |( s* O    }
" P+ Z3 [0 m' ^% s1 b- i* Z$ f8 g    if ($request_method = 'POST') {
        set $cors "${cors}post";
& |" I5 \/ E7 S, W! `1 m& b    }
) Z6 N4 n5 {/ b: Y7 V" c$ f9 w) R
( @$ n8 J' g9 j    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
4 T7 r7 H# q" y3 q% g+ R8 p    }
# W* z/ m9 l- ^% M# H* ~
    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
6 f' W' w# r6 P; ~        add_header 'Access-Control-Allow-Credentials' 'true';
6 \% _' k/ k& k# ?        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

% @$ S; d( ~4 G' S1 X+ L+ G5 O4 }6 D    if ($cors = "trueoptions") {
, `8 x( ]: s) j5 \' ^7 s- S9 Z8 I        add_header 'Access-Control-Allow-Origin' "$http_origin";

: Y. A$ r6 v$ Q# ^$ s  ]: P        #
        # Om nom nom cookies
7 Z% N# w. S7 j; q% ~$ p! N' u        #
0 v  u$ F" O4 h0 ]/ U        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
1 S9 o) A8 ~' Z9 [4 x& l
5 g/ S: F8 G. H        #
        # Custom headers and headers various browsers *should* be OK with but aren't
7 g+ m& o* A: ?4 b/ x, n        #
& e, X" o0 d% k/ q1 V        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
% @4 F) z( r3 H- C
        #
        # Tell client that this pre-flight info is valid for 20 days
- K# D1 q( U5 K& ?6 x; t5 Z/ r        #
" v! `. Z& F; @, V2 B9 B7 Q0 ^1 a        add_header 'Access-Control-Max-Age' 1728000;
4 S5 A# V) m* a) w5 C        add_header 'Content-Type' 'text/plain charset=UTF-8';
9 V4 S" J) D1 W        add_header 'Content-Length' 0;
3 o8 i" a/ p: [2 K* R& i4 e        return 204;
# o% f! ?% V. L- @' e/ e( W    }
$ r2 J% A& s$ Z
2 t+ C0 l; }, R, _- e% Z    if ($cors = "truepost") {
( F/ X$ G. f( R; _' v  @0 P        add_header 'Access-Control-Allow-Origin' "$http_origin";
3 M2 h9 t; I% V! f6 b        add_header 'Access-Control-Allow-Credentials' 'true';
7 v( r9 p, x( f4 O        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+ U' X) `# N. r8 E1 T7 u; P        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

9 Y+ D0 L% `& h, C4 [' W* M1 r}

( |) \3 c, T# p$ O: \9 J  F
* E' [+ p5 n1 I2 k) t