Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
' S- w* P: ]  A  r
$ Y% w8 k! f) q! y1 S2 t
1 s6 H/ o0 @$ v6 f1 ]

# CORS header support
+ Z/ f) W) \  d1 D#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
5 U, |# m, ^$ }# o+ J# statement inside your **location** block(s):
#
#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
; O/ y5 Q5 K2 k% U#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
- R% I) A# I) f% o. w8 `#
# x% B* [# T+ I! @! J. r. G2 [/ X
1 W0 A7 j" W' `: z0 a, B4 Uset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
+ S$ y4 k% i+ n& j4 O; k        set $cors 'true';
/ p" X: W" \0 J# ^+ E. x8 R}

: c" x4 C2 J% B% A' f6 V/ jif ($cors = 'true') {
% D( K: v0 Y" h$ o1 q* q        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
- m+ b& b' c$ ~" ^        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
( P3 k. G( I) g/ e" }/ ^. \% n        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

4 }$ q, {5 A& g  [' t  N  Y/ |$ ^if ($request_method = 'OPTIONS') {
3 S: I8 A2 H  L2 h6 A( \        # Tell client that this pre-flight info is valid for 20 days
' _- A, v1 x7 o1 b) ]' }        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
0 ?# @2 p" s& m' z        add_header 'Content-Length' 0;
        return 204;
% t, [; ]5 U3 l4 U  N% f}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
# ]+ n. I' I. c+ w}
set $origin $http_origin;
6 q6 w7 G% ^. f7 \if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
. x) Y; m" I3 D; a     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
1 u* j( I0 [2 G2 E  K0 x8 ?8 P     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
' l. u( a, A7 R* G, y3 ?( w     add_header 'Access-Control-Allow-Credentials' 'true' always;
( I! V2 I+ D; T5 ?0 B* X8 d     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
) m. x0 D* a! m2 X  {; ]8 N4 q  L6 R  a     add_header Content-Length 0;
; c0 A+ D5 D1 W$ A     return 204;
}
0 p' R0 ]9 Y- }. Qif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
8 F# e$ [1 X7 |3 ?/ b     add_header Access-Control-Allow-Origin "$origin" always;
2 t& B' U0 {" `$ h) |& T  f4 i* F; m: d     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
* n* v) K: q) ~#
7 Q, ~4 P4 h2 f, u! W" F+ _# Slightly tighter CORS config for nginx
#
1 L1 Z5 W. `/ _6 x# u# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
( K! j, }" T- V7 E4 Z5 `#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
( c1 A6 \6 b/ }' z( b# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
) i# f9 L. i; s3 j# R# T# method to control access instead.
#
) A% S, A' A2 T( o6 {# Y7 H# NB: This relies on the use of the 'Origin' HTTP Header.
5 T5 r; r5 z  y5 s9 J+ @4 W
" `+ A5 u, u0 k6 I. K$ i# V  t- F2 hlocation / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
+ \( Z. F# W- v/ |- d6 M) S
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
3 y4 p  S; r8 w- q        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
5 E5 Q# w4 R% u6 V* L% t5 `" `    }
! T  g/ x$ o0 @* ]5 k9 y# ~/ W# U7 c    if ($request_method = 'POST') {
) n0 P7 J& Z4 g        set $cors "${cors}post";
3 K) P9 I$ ]# y1 k" f    }

    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
5 F, t# f% c/ |0 l  g4 G$ t    }
% g" }2 K" [4 w( y  l" ~
    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
0 t3 }# z/ B2 c1 c! \        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
$ J, F+ r/ d+ G# o/ H) p1 t
2 ]( r* x0 |( P' s% }        #
7 z6 q- E7 O0 o, E        # Om nom nom cookies
( W# R4 J+ `" k! V. O4 ]/ A        #
# |# T0 d% a6 q2 \/ W        add_header 'Access-Control-Allow-Credentials' 'true';
+ c* f9 ~) ?% }! R5 \5 r! c* Y        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
8 P8 {1 T8 H) S$ g+ q. s, f
+ i$ ]# @2 _7 g% x' r% V  H        #
        # Custom headers and headers various browsers *should* be OK with but aren't
3 j& U) \8 m. z2 ~, ?: Z9 [! L8 E        #
$ b% ]2 h6 F* S        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
3 Y& B9 @; j- Y4 Y, F* r0 |
        #
* X5 g% h% T* N3 _$ n7 L- [$ U) r        # Tell client that this pre-flight info is valid for 20 days
        #
8 k+ B  \3 a& _  L        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
4 N3 v& n1 W. k# ^, H. \: m        add_header 'Content-Length' 0;
* K% N; \, e* q3 z+ h. a5 A$ v        return 204;
8 R% n0 r- E9 V" W! \0 c3 o8 @    }
# K0 t. e% C$ c" F3 ]) m5 z
    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
" N; Z1 I$ q( o& q* _        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
6 Y) _! M  d8 @8 d- r3 c    }

}

! M4 ^3 u+ |: K* i& |
1 [3 h2 W) A$ U9 Q