Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

! E% F" Z' h; F) Q. w. r
0 E( n9 z% p/ M

# CORS header support
" U4 ]& z/ j$ ^# U- z#
# One way to use this is by placing it into a file called "cors_support"
# ?9 E4 w  d6 T9 p) [" j# V* l# under your Nginx configuration directory and placing the following
9 d( C% n  o2 l3 L3 }# statement inside your **location** block(s):
6 P6 b( i7 H- z. o5 l2 G#
9 `3 w3 e, n1 W#   include cors_support;
& f) M8 \! P& h( l% W#
5 b( D( n- l8 p4 g2 U1 \# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
& {& L3 p2 B& X- u" `#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
4 [1 R9 q) C: P; I1 W4 K8 q
set $cors '';
7 R4 o' @; ?6 k' y. t. S; h2 G2 w5 |if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
- I! U' z: N8 P4 h% H! N        set $cors 'true';
}

if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
8 h# ?* W. v* W        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
7 y6 F# v2 L/ u9 ^: k% l9 N, E

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
7 B2 F; k# y: M" Jset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
4 B8 q' V$ J1 M  q2 R}
7 a8 x& n# c2 c  n. Qif ($request_method = 'OPTIONS') {
/ P* B# |: A" N, h' H: q     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
( a' _9 k* N$ K! ?2 u( w  g     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
6 ^# L- ]9 v/ d+ f; P1 V) y     add_header Content-Type 'text/plain charset=UTF-8';
* M- C! `4 }0 K/ N6 t4 y* t# c     add_header Content-Length 0;
0 H' x, H/ C) ^$ e3 u5 `6 G     return 204;
& C. z' f) t3 P8 U9 T}
5 ~3 U/ W7 c: Kif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
1 v8 v) B- p' t+ P: f, y4 R5 \# }     add_header Access-Control-Allow-Origin "$origin" always;
* j+ U' V  y- G8 [3 B! O     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
& t2 Y# Z7 G, d2 n! k1 E     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
#
* ]# z# I6 \* R# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
: `% Y' H2 l, ]#
* U3 {, d2 `  Z+ t- o7 y# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
/ u2 S4 J1 `( ^* D0 \- `; `! Y9 t#
/ D5 ~) }; @% s# G, Z/ f# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.

6 X+ c3 y) f  c5 X' Mlocation / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
& l% U1 d9 g  f- U7 Y        set $cors "true";
7 c! x& M6 m7 M, w5 P    }
% `# [. z7 r0 R. L) X& \
/ R* P) R* k# b. V9 w    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
8 `# S. J% s  G    if ($request_method = 'OPTIONS') {
! h. S3 V& N1 t0 O' Q. o! m        set $cors "${cors}options";
* g8 ^6 g3 a) \6 ~. w5 w# A    }
8 l  F: ?) U1 B; U# u3 i    if ($request_method = 'GET') {
, Y8 ~+ x8 D+ @7 Q) }& r3 G        set $cors "${cors}get";
6 n! j( U3 y% h# L    }
3 Q( l% m* k* J5 l4 N    if ($request_method = 'POST') {
        set $cors "${cors}post";
" |. E) L6 F  ?    }
) {6 ?/ [- k2 ^( g5 J
    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
% \. d' s. {% Q2 o        add_header 'Access-Control-Allow-Origin' "$http_origin";
9 j9 I: k  F5 w: F$ i$ u# j& W    }
  `' K. ]2 }$ n2 A9 ?6 q/ w
& r, j: E+ M- A! I" A+ O. T) w    if ($cors = "trueget") {
+ V: ?7 R+ p# f& I5 x9 o8 j        add_header 'Access-Control-Allow-Origin' "$http_origin";
# o, ]; j6 k5 {) Y; B( L/ n1 f7 o5 {        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
' ?" T$ c$ z6 B$ w% d  Z2 T
    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
) C5 H, P5 M, t) A& G" ^' A
, M2 R( M) p# O7 ~% K        #
        # Om nom nom cookies
! B8 V" f+ z0 I, R& m3 H        #
1 q0 k3 r. x" ]. q/ U9 k        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
7 L5 E7 a+ g% o6 R7 S! V0 i
        #
2 y* g# _4 Y2 @% I        # Custom headers and headers various browsers *should* be OK with but aren't
- ~' U% e$ U$ _1 ]& P" n5 o        #
$ d# Y9 \* L- l1 d) c        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

+ y! S" T- k( ?( ?9 Q- Y2 @        #
        # Tell client that this pre-flight info is valid for 20 days
5 S3 x9 @4 b; W) ^% O' Y        #
' d% U5 R7 s# Q3 f( m        add_header 'Access-Control-Max-Age' 1728000;
$ Q) o' r5 \- T5 D- Q        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
/ j, C8 Z1 e9 _6 _: t        return 204;
    }
  o' W0 k0 W6 s9 G3 U2 W
    if ($cors = "truepost") {
8 _7 Y) n0 m. _5 Y& p% L        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
3 I) L! t# ]% E
}