Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
- Q; I+ l' Q' f) g
& G# e) v( q  D& ^

# CORS header support
1 x( o4 Y' K( D& Y. u$ J#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
% r9 Y1 M0 w5 _* {) C# C  T, J# statement inside your **location** block(s):
" o& y" K1 M; n/ N0 u5 q#
$ n! Y' H  H6 v. e0 l1 l8 _% h#   include cors_support;
- g5 S9 }+ b( Q+ l- g2 }$ }3 N#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
9 D! b- L, F+ O# F1 x! T) @# allows CORS to work if the backend returns 4xx or 5xx status code.
#
* ?1 v3 a4 p9 g4 x# For more information on CORS, please see: http://enable-cors.org/
2 d4 p9 m* F, J% g: ^! |# Forked from this Gist: https://gist.github.com/michiel/1064640
#
* B; z3 n: f* s$ L6 R- V$ I7 B
: d. C3 _3 Q9 [set $cors '';
. \  j& H& Q1 N+ r, N' A* Hif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
. l# `6 j$ E& Q0 f}

% I" s  x3 F0 \) t$ C+ B1 eif ($cors = 'true') {
( c6 y! T) m1 n. r        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
- D2 g5 ]! O. E. s4 R        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
) F2 B; u& h' \+ l# R' b  J        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
% x% |9 L: h1 I( b  ]}
/ b+ p$ t, T9 X3 u! J! i" a# S
if ($request_method = 'OPTIONS') {
! E# S/ n, b% u) h/ k( I5 E        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
; n" o" Y3 z( V7 {        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
: r$ |! K. ~8 W

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
2 T% c6 M- ^% Q% Q0 j6 M}
8 h& q* s8 a9 i' f% n: f/ s9 Xset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
, ^3 _5 Z3 `) g! s! x6 ]if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
) Y* C$ q: P) r     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
% ]: P! J! F% a5 i7 [     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
$ H9 T& F9 Q: ^( o6 t' u! U     add_header Content-Length 0;
) i+ M! V2 E8 |     return 204;
* ^, U* ~9 w, L. m# C}
- d+ C! H1 p$ P6 {; ?5 B: Bif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
! z$ l9 {$ l6 S#
8 Z( c* ^2 ?/ G9 k5 i# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
2 B" Y& N2 @. {) L+ E; F. L# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
5 D3 }3 v# F5 D8 a4 w0 N% \# V2 V#
4 o2 c% S: K9 ?, E) [3 n' Q: [# NB: This relies on the use of the 'Origin' HTTP Header.

location / {
3 n' C" G- V# k2 Q% ]+ d: @
+ C! i. U& p% a, Y) L' A  s    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
0 m, x3 l. m/ x, U3 A) t        set $cors "true";
/ g/ R. }) N- E- \. E# M    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
" _/ Q4 W, i/ H/ Z, H# M    if ($request_method = 'OPTIONS') {
  V# g: e* R9 ~" V% ]* ?        set $cors "${cors}options";
7 {4 {/ D# l/ C& ]    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
( l; \( H" W* D4 C' G6 g1 o    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
& F% z6 ]/ a5 I) O- m- D    }

    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
8 y- g' v4 }: O$ d1 |, y    }
- l' C2 P8 I8 p" k' ~
    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
& B% k1 `4 I$ M$ `        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
3 z( f- f" T  R1 L        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
2 I5 @  V; B+ O( Y+ Y- |2 Q    }

: Z- k% i1 d8 C5 ~0 ^* y5 t* q    if ($cors = "trueoptions") {
9 \8 j* |# v8 L2 ^* j        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
& a# e# {0 E$ y        # Om nom nom cookies
# ^: F$ S5 t! B2 D        #
5 n0 w* l' x; [& k2 s$ |9 B; o! t        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
/ m; K; W5 Q# E" ?/ N/ K% E
        #
1 ?( U. t* {# n        # Custom headers and headers various browsers *should* be OK with but aren't
; W0 F" Q2 l" [1 V5 o        #
6 y: D: S7 U4 |        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

( s! w3 d! U4 ~  R  ]) h( b8 Y        #
2 ?3 ]6 N, g! X+ a9 W. F" ~9 C; j        # Tell client that this pre-flight info is valid for 20 days
        #
8 {( s1 l5 e0 A; M3 x        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
1 f" U6 }! D+ I1 e% M5 Y        add_header 'Content-Length' 0;
        return 204;
! r6 G8 c* r. Y5 z0 q    }
) M. H8 H" W: R' ?
0 \& O; _  h* @' @" W+ _7 C, P    if ($cors = "truepost") {
! [/ b; H; W4 \7 n& j        add_header 'Access-Control-Allow-Origin' "$http_origin";
$ m# K" U3 G3 C% h5 j  w& g* v, ?        add_header 'Access-Control-Allow-Credentials' 'true';
/ a/ f- U9 p( D        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

}