52AV手機A片王|52AV.ONE

標題: Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源 [打印本頁]

---

作者: IT_man    時間: 2019-2-20 09:34
標題: Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源
以下是gist.github.com支援reverse proxied APIs的範例:
- E0 U$ J% X6 v+ s2 Q' W" Q2 y

, A/ I# I" y& G& D5 O+ h' _

# CORS header support
#
% R( n- {! ~4 B4 k1 H5 D4 R# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
#   include cors_support;
#
0 @# U( p, @2 f# As of Nginx 1.7.5, add_header supports an "always" parameter which
5 L5 L/ X% e1 A; _( j( s, m" j# allows CORS to work if the backend returns 4xx or 5xx status code.
( ^2 ~" Z8 }( @% M#
# For more information on CORS, please see: http://enable-cors.org/
/ `' \( x5 B2 _% D1 T4 E/ D# Forked from this Gist: https://gist.github.com/michiel/1064640
#
0 @! ^. }0 e  `- C
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
$ G; |6 ]  I; @' R+ Y$ c9 b1 S}
1 f* G0 ?! o, w8 n, [0 b
if ($cors = 'true') {
/ `8 D  T5 M7 T: e7 [4 B2 M  h% o        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
( h8 b" v* [9 u+ V) e' f        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
" A2 Y/ m& A* e6 f& t8 }. d        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
3 p; E2 i. |  h* O# T' p* T        # required to be able to read Authorization header in frontend
5 S- e+ ~( D2 _2 D        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
1 `# c( h- z) u& S" v/ @
" \0 g* v" z6 Z* d! fif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
* E7 f0 N5 a- v6 d% ~        add_header 'Content-Length' 0;
: z- }& V3 ]* R! k& E' N% L" e. |        return 204;
: h8 X; a6 F) F% C}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
* l  L  r  h8 @& Yif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
9 E1 a6 z  Z' _; h4 Y2 `& ^}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
( t" q& s. t# `1 \! x, j3 l* ?     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
+ L: T. k0 n+ |* p5 A; S+ i8 K     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
3 H- _2 o/ h' L1 y: ?/ c( c     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
  P" q9 r* X' T4 n6 y$ }     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
- |0 B) z; E7 A8 @9 J- ?     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
3 G- t+ }" Y! ]& V/ Q) B9 t- a$ H9 H# Slightly tighter CORS config for nginx
6 Q7 E) D$ I' n1 [. ~#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
. U- g8 a/ X% O#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
/ x+ [: ?, [' k! g9 a5 Z$ r# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
# h0 E9 b6 U, P( {  G; h#
4 \# W. p5 c& `& A' K- W# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
, m- o1 t. W/ O5 ^#
# NB: This relies on the use of the 'Origin' HTTP Header.
3 b1 l# r0 a8 c: s0 E
3 T) N# f; C# J2 E: Q4 T$ M5 ]location / {
. V, q+ }3 Y+ t* G% }
# R7 d5 U% ~3 T7 t  b6 _3 G9 i& \    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
9 u' E; H* p& q- B3 n0 a; [
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
4 I1 S1 W6 ^7 I! R/ c% c6 c    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
! }8 p- g( a- V% ^" I% y: V        set $cors "${cors}options";
( @6 G4 Y& x$ G7 j7 J' o' E& {    }
0 y" p9 [1 l1 V% ]9 z    if ($request_method = 'GET') {
7 U& b0 ]7 ~5 |% f+ @        set $cors "${cors}get";
' K9 R+ _, ?. n# X7 t/ b% y    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
" j8 Y$ f5 c9 B! x    }

- e, q. t4 n9 d7 c8 n0 F    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
. b* \; }5 T8 f( h" r
# `4 p! R6 n% t7 L; c1 \" b    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
! c/ @8 z+ j8 O    }
: M' x+ w3 T- L! y  ~
0 E6 m; J+ ~+ ?' H) x0 C1 g( a: c    if ($cors = "trueoptions") {
: R9 f2 N+ d# h3 j        add_header 'Access-Control-Allow-Origin' "$http_origin";
# ^) p  _4 p7 y" f9 t5 g
( y1 X  U2 ^1 X+ h; M. \: B$ A        #
        # Om nom nom cookies
# \2 E% M  L2 _. e2 u        #
        add_header 'Access-Control-Allow-Credentials' 'true';
$ n8 W& Y& Q; L$ C8 H        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
$ W: N. u2 f  T+ w* @+ |* q
! |: @" e, A, I5 O. M, [1 i        #
  |; U& b9 O  B1 u* W        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
! W4 |0 N& A" N6 `+ @* t' ~: e
        #
+ _8 M2 M# G/ g; j/ r0 ?6 W) e        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
- |+ A" _1 Z3 _: ~6 E4 C        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
  \/ n3 f1 `$ |8 H        return 204;
( m* n* r0 M/ P    }

( |  q$ Y& T6 F& q2 E2 H& ^    if ($cors = "truepost") {
8 z- p/ A; F" G0 L3 K        add_header 'Access-Control-Allow-Origin' "$http_origin";
% R/ q9 S3 t3 u        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
0 S1 w0 u, q$ J4 V6 M  h/ S; w  f3 @        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

% d! R% ?; K- ?- K7 g3 ^% `- F}

---

歡迎光臨 52AV手機A片王|52AV.ONE (https://www.itech.casa/)

Powered by Discuz! X3.2