Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
  |# j, ^4 f5 s

# CORS header support
#
$ L+ `# R9 \7 V; T* ]# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
#   include cors_support;
/ b8 D- ]+ R4 s: f! y, h/ V#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
# T$ ?3 L6 \, H% s3 ?! Y& y6 c4 e# Forked from this Gist: https://gist.github.com/michiel/1064640
#
+ X: ^" m' r. Y1 s
9 F% I# y8 Z+ ?, c+ j: Rset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
}
+ T8 N% H- U3 a( M
5 W4 K+ }) P4 a- wif ($cors = 'true') {
5 {" y. Z% m+ O9 z  G. L        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
6 u# ~: q) s# ]% P        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

if ($request_method = 'OPTIONS') {
/ `3 I' v5 j! d$ w        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
  h$ G! m: v% r1 w+ |' \        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
' Y* U8 Q: Y0 D: W) V( n7 [% lset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
8 j7 s- h+ |  v" V& c5 _     set $origin 'https://default.yourdom.zone';
  r( P: k7 @0 j$ }' w3 a& \% i}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
# j5 J" K8 \3 }     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
, w' P" V4 f3 O$ M     add_header Access-Control-Max-Age 1728000;   #20 days   
- O4 |( [; J5 |     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
0 v" n% ?2 ~; |2 J6 K2 N( B! r}
) P# i2 m6 I) g; Q' q! |8 Nif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
/ j: F# t* D3 \     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
) j0 V, D  E9 u     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
7 Z0 u6 ~, z; S! v#
3 @' n* j' _9 O% V9 A# Slightly tighter CORS config for nginx
6 T% f" f* U9 b0 d. ?( k#
2 T: k* m' @& a0 F6 ~" n! m! P9 g# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
9 E# [/ `( |4 n6 {$ D#
! }+ z5 m+ N( h5 {% }# Despite the W3C guidance suggesting that a list of origins can be passed as part of
1 N/ X4 K6 Y2 H# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
- A9 h3 ?) p8 ~9 N. s7 m2 e# method to control access instead.
#
1 u! Z# m8 {% |( s2 M# NB: This relies on the use of the 'Origin' HTTP Header.
2 q. S8 a; r: |7 g4 D8 B
: q- M# }, m8 Z* \3 `$ slocation / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
' A9 E! t  E5 V4 u) A6 \+ c        set $cors "true";
    }

4 j* R' O8 O4 F& p. c6 ]    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
; @+ Z* m- A7 }3 v* {# D    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
; c) Y* A+ K( i* e        set $cors "${cors}get";
. z+ U" b/ w! N  ?    }
    if ($request_method = 'POST') {
. P, K8 n0 |( I        set $cors "${cors}post";
# v6 C) R) [4 _" d8 X0 u    }
2 R" t5 h% |' q  W
6 H: Q* Y  q0 ^; [& Y    if ($cors = "true") {
; e, y* q. i" \' J! p  @/ P1 l        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
) J0 p  B, A6 \2 i7 [! |    }

    if ($cors = "trueget") {
+ `+ Q- Z: P. F) f# D9 w% y        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
0 W# N, y! R1 f' B# T! K
    if ($cors = "trueoptions") {
/ q# b1 A0 U/ V( i        add_header 'Access-Control-Allow-Origin' "$http_origin";

2 L6 l2 ]2 x2 l. ~4 ?+ |4 ^        #
        # Om nom nom cookies
        #
$ q3 R  x$ Q5 k$ p        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
# ?# _: w2 }' d5 K9 g  S+ X# I
3 T4 S0 k. H; L, d7 j        #
        # Custom headers and headers various browsers *should* be OK with but aren't
; z' Y: @% Z2 @) v5 g  Z0 b3 q: F        #
* \. \$ ]) }- a        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
        #
) ~" T. S! z5 {9 D        add_header 'Access-Control-Max-Age' 1728000;
, r" z" ?8 s, h. O& c, g2 W        add_header 'Content-Type' 'text/plain charset=UTF-8';
& {0 x/ r7 J) r0 C        add_header 'Content-Length' 0;
0 c. F( j/ F% j9 A4 ]% g        return 204;
    }
9 ~) l- V: _3 }! Q9 H
    if ($cors = "truepost") {
& @2 x( o1 g$ A/ \& n: U        add_header 'Access-Control-Allow-Origin' "$http_origin";
1 e8 J# o* p6 \& Q/ P/ n& o0 [        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
% T  E/ t4 f. r: [4 X4 s+ K
}

  X) M9 a( \& s; x' A