Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
2 P& J4 u6 R4 g* s8 i+ }2 e% y
/ M: e5 e  B  q
  z; k, A; q7 `- j9 p

# CORS header support
3 ~0 P1 ^' {9 A0 \! P+ {#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
' q9 S5 ^: l/ h+ i7 z# statement inside your **location** block(s):
/ }/ ^6 c) X2 v, C1 a. B#
3 i4 |, O0 p( u2 P$ |9 ?# J7 g#   include cors_support;
1 S% w# R3 s2 M& E9 \# ]: _$ x- m% i#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
1 ^7 x/ L0 r2 d" D' H% b: `0 X9 n$ F#
# For more information on CORS, please see: http://enable-cors.org/
1 p( [+ N1 n9 h. I# Forked from this Gist: https://gist.github.com/michiel/1064640
#

set $cors '';
  |$ o2 w- F2 x5 @if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
! q: [$ S9 {  t" }) E}

if ($cors = 'true') {
! f9 X$ M. P1 a. e& i9 W/ {        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
. J5 j# @: C5 T" ?8 x6 {        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
7 h% r4 O- C- U8 F        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
9 O1 h9 Q" d+ m7 X" [3 r; v}

7 G1 J2 B/ r# S' M1 K' F" r% Uif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
1 `) j2 P& z6 o, g- U# L}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
! R, [) K4 u7 \" L6 U8 J3 G6 H     add_header 'Access-Control-Allow-Origin' "$origin" always;
, K, K/ M  z3 H6 T8 u1 s# _3 R: k% _     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
! G! O/ Q1 N$ E" O/ }' g+ D     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
2 W- G9 P: X, D6 k3 f0 U$ J}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
1 o/ U' ]* U' f0 v, B; k' L     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
% H$ a, h3 P1 d. Y: S#
0 h% |7 |) _) l' `# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
* Z9 n. _( W& M$ o# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
" }6 M0 v8 z- ~% D4 }0 g# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
' y7 i9 u) l. f1 M" l' L3 G#
$ Z5 ~2 _) y( i% w& G# NB: This relies on the use of the 'Origin' HTTP Header.
6 U' z5 m  l8 K6 d5 \8 k4 }: c
location / {
6 ]1 j4 i* u3 V7 Q, q) n! \2 Z
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
. u3 H2 ~% p4 J! {3 n: K! c  Y        set $cors "true";
    }

, c; G' D2 ~4 I1 M  z3 V3 {' a9 n2 k    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
1 u# H! f% G* B) J) p    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
4 Z7 V% j+ f# U6 M* p7 o    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
/ _$ x6 t! M7 L- ?        set $cors "${cors}post";
    }

) t8 V0 t- [2 i9 z& J' |. y& O$ i/ t    if ($cors = "true") {
5 `& W! @/ X4 e  d" J# j; w" l        # Catch all incase there's a request method we're not dealing with properly
1 L( g) s9 t) G) l; n; `9 \        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

5 z4 C4 e6 v' V  {- [    if ($cors = "trueget") {
, R6 O! f- G, i7 t+ E1 `+ R        add_header 'Access-Control-Allow-Origin' "$http_origin";
7 y  U: _8 }0 l# G7 }: Z        add_header 'Access-Control-Allow-Credentials' 'true';
0 j* s- ^1 t+ P" B+ `        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
: }* s0 ^) Z5 P$ m, P5 W8 a5 ?        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
: p, h0 b$ W4 o; K4 h) D: x" h& m5 ^
    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

( c' |. B3 @; _        #
$ B' O/ F, e" L3 I7 P. T8 G        # Om nom nom cookies
/ j2 p4 f8 F+ f$ X; i" S% H4 e        #
        add_header 'Access-Control-Allow-Credentials' 'true';
) k5 W, W4 A' F8 n7 I* ~3 e# q% \        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

6 s, k" w; u6 D/ m# S9 y        #
        # Custom headers and headers various browsers *should* be OK with but aren't
8 l$ Z4 t5 [$ v6 j7 h' r        #
$ @, M% {" r) u        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
( H  K, y( Q, m0 B3 D
- [" G4 V* s& l        #
5 t2 n) x7 j8 G# E        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
# W2 d: l% L1 ~+ z        add_header 'Content-Type' 'text/plain charset=UTF-8';
3 b! U+ I: \6 x# W        add_header 'Content-Length' 0;
        return 204;
    }

. R: N5 j" W+ g* i- Z    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
1 C( ^- d! D4 @9 e* t* D% j4 R! G        add_header 'Access-Control-Allow-Credentials' 'true';
2 o3 d& l7 L$ _+ F9 {$ I2 _/ b        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
& e9 W5 F$ X$ V: ~- A3 M        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
  w3 z/ I3 R2 H" g$ [    }
& E8 a$ [8 A) L: }7 Z3 }4 g
}

3 i0 H3 T# O4 P9 N% G