Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

% B0 a; e$ p( W6 S' Z8 S* Y7 p0 _

# CORS header support
#
7 F3 j- H; d$ [/ Q# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
4 O8 r9 K" Z& Q# statement inside your **location** block(s):
#
2 p, d  }, n! W. J#   include cors_support;
#
9 M) `) V# {5 R" d- c, t. q# As of Nginx 1.7.5, add_header supports an "always" parameter which
( e% U" X, Y! h- G, Y2 X# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
8 C1 [' e0 m1 d7 [0 w8 S# Forked from this Gist: https://gist.github.com/michiel/1064640
5 _, T, w& u- z+ ], e2 Q#

: i3 j6 O: r+ a7 @1 S1 D. jset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
( z. u* o. D, J* m7 J; o        set $cors 'true';
5 Y2 H0 e$ e- C  K# r+ ]& U& r" \}
  f' H1 u7 F2 N7 \- q, E6 u
if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
; L  ]( X* D5 r+ U: Z, j        add_header 'Access-Control-Allow-Credentials' 'true' always;
6 @2 q' e7 q* @0 o0 S- o. j# ^: U        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
8 b+ B8 d2 P- y: B5 A9 a& Z1 z& f        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
* w; @  d1 u8 V5 z) Y6 [8 y' F0 G# t        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
/ `: R" i) H' e        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
. p0 }3 o: J) h$ i  Q        return 204;
; S' f$ O3 z* ~  u% z) D}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
. d! f) V6 j% Q9 d; ]% k3 ~7 k( v0 s

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
( y5 m) x* O, W1 P}
set $origin $http_origin;
+ x1 O0 I3 ^- j$ H. Xif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
2 q% i/ ]& A5 j5 a6 v     set $origin 'https://default.yourdom.zone';
}
& {; a+ g$ u5 Zif ($request_method = 'OPTIONS') {
  `! o0 v, {! w9 t) J$ @- S) s     add_header 'Access-Control-Allow-Origin' "$origin" always;
8 x8 R2 P$ b2 w     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
4 f8 y7 m% c/ z# o     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
5 b/ o0 r# D. c$ ^0 o; `     add_header Content-Length 0;
     return 204;
( t; X/ C- S& l, V% |8 j}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
5 i' Y8 n* U7 L  z+ ^     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
8 Q4 k% c+ o0 N0 `! w}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
3 Z. |7 w& p3 g  \#
- J+ f" c$ v3 F% p, h. [2 E% C- X# Slightly tighter CORS config for nginx
3 b2 [, K9 g: h$ S# u#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
+ R6 l+ B, `" a& j" ~# Despite the W3C guidance suggesting that a list of origins can be passed as part of
  z2 t0 {) j5 g2 B5 W2 g# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
1 f  G  r9 c7 d3 X7 P; v, g# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
+ E1 c/ ?4 V4 c2 j3 t# method to control access instead.
) B6 m! D$ X% C8 J" ~8 B2 Y, R#
# NB: This relies on the use of the 'Origin' HTTP Header.
- b, k$ @; ]6 ^6 Y( ?, w& r4 ^/ g
) O. g! u, k9 N" `* C2 X0 l3 Zlocation / {
! {/ y" y# D: a6 `9 \$ s% Y
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
1 A6 L0 A' B9 J) @* l! u$ T& y
  h* Q5 Z, E" `- q3 v1 c' B    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
& h; D7 k, B) {9 ~& \% F    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
' u, _0 j, C% T    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
! W8 t: S# z8 _$ E0 f$ d    }
* V! `( ?  W- v1 G6 H7 U
( W. p" R# I' U* L6 S0 v) j4 ~    if ($cors = "true") {
: l1 c- X# B% Z. f) n% h        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

- e: o$ y  {8 `5 I* g    if ($cors = "trueget") {
4 @2 {  U; i0 \* a+ n' K! \" f1 @$ j( E        add_header 'Access-Control-Allow-Origin' "$http_origin";
& R! Q- @7 _; j: z$ W" B: r: U        add_header 'Access-Control-Allow-Credentials' 'true';
. u8 x. r( u  C4 H% b+ k        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
7 ?, S" m& W1 N        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

3 L+ R% v1 y, ?9 G- b- o% h; _    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

" D* s' \3 x2 @/ L        #
4 ]7 B; z/ j% V: x& y) n, r. U5 ^        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
* J3 M. }' @  ^/ I! m* ?' Z5 |        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
, p# W0 L( A, n. W- L& I        # Custom headers and headers various browsers *should* be OK with but aren't
        #
; j! K0 I) {; x) N9 k        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
# D  ^1 O& p& }6 m8 Y+ k
5 v# \* ]6 ?# H        #
        # Tell client that this pre-flight info is valid for 20 days
        #
6 K( c2 Z/ X* r3 h( {  p        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
    }

$ h: R& h$ p$ U# A    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
3 t# b2 `; z) x; q' X0 G- i        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
. z. }( M/ i' `. u# V$ t! y
, r0 ?% L3 x' W+ I6 B$ F}