Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

( r  L3 J" e/ _9 B8 P  u
! B: b& k8 M2 a6 L" s3 Z. }; g

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
# k4 {+ d) O' f. t3 {; h$ c# v# under your Nginx configuration directory and placing the following
+ M+ Y( o" d2 m( Q& w# statement inside your **location** block(s):
; l& \( Y4 @& y( R. B; R9 d#
4 q: H, u1 p- T- y" S#   include cors_support;
#
" b- ~" k% I9 d- p% r% e* @# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
' R- h# _) |: G# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#

set $cors '';
7 y3 h* W( p( h* v  h8 n! Nif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
5 u8 o7 i8 L- K/ \9 F7 l/ u$ ~. @0 [        set $cors 'true';
}
: W2 q# j7 w( @( R; M1 {0 ]
$ [( \% M9 o) g7 q4 Xif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
0 I* m) I, K: m9 a9 M+ v. n        add_header 'Access-Control-Allow-Credentials' 'true' always;
2 |* h6 n* D8 P  P5 i        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
6 |& m0 L6 b* u6 r& g4 H1 N        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

) Y& ^. ~* g+ {if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
) s9 m8 N3 i' R& B7 L% `        add_header 'Content-Type' 'text/plain charset=UTF-8';
7 b. _* C+ x; F$ C6 m1 f& b8 B        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
8 z( h; j. {4 O8 y     set $origin 'https://default.yourdom.zone';
}
/ W# t3 W( k' K2 Q. [$ M. a5 Cif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
  E! |, a7 {4 i: o     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
" Q8 Q$ ^/ T) q8 I; F+ T6 l     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
( _/ r. `' H$ C/ ]     add_header Access-Control-Allow-Origin "$origin" always;
; R8 z9 ], D2 I, Y7 n1 B/ [7 X2 a     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
: c* `- E4 Q/ Z2 |: V! o3 O, D     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
# N2 h0 v* p; P9 G' u+ @. H     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
% s3 w. [) e" J#
. g* p. c( V7 c+ G6 Z' v# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
4 b4 x/ ^$ }/ x0 s6 m' j  t#
; V/ j/ [) S5 h% |5 Q. w1 b# Despite the W3C guidance suggesting that a list of origins can be passed as part of
" ?0 \; N" q# L* b* ^# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
& ^4 r9 B% g  m# a; c7 [; z0 l# don't seem to play nicely with this.
: J) b! Y3 X7 A' q4 F#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
/ h6 T; ?: X3 a( K# method to control access instead.
#
$ h1 V6 d& Q* R  k" M0 x2 b# NB: This relies on the use of the 'Origin' HTTP Header.
/ p' h6 w  \% K. f0 F; q
location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
, J. x2 o. v) R! u7 N0 \
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
- C. h3 |) P% `    # Determine the HTTP request method used
. s+ d! _: A7 g6 X" a- i    if ($request_method = 'OPTIONS') {
7 }0 e  l3 i& S! a; H        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
9 ~% [. r/ h  ?# s! p) J        set $cors "${cors}get";
+ p, c& y, v: q$ l5 c    }
* C2 O" s. o2 E( \9 o) M' P    if ($request_method = 'POST') {
. d/ E+ f; W* K( s* K        set $cors "${cors}post";
1 }7 Q' b) E0 i. A    }
$ N9 q6 V+ o) ~# G* N, S. `% O
    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
0 @0 K$ E: z' N        add_header 'Access-Control-Allow-Origin' "$http_origin";
. `; p+ y% U. m! i; G1 n3 {    }

- e$ Q. }& ~1 B5 ^/ u7 l5 e! R- m    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

    if ($cors = "trueoptions") {
2 w% k3 x- D9 }. P, g9 n2 I! J; ]) s        add_header 'Access-Control-Allow-Origin' "$http_origin";
( [6 g% h3 ?. w# r) v7 p$ R* L) A' z
        #
4 N) c, K9 b4 U8 d/ g- k. s        # Om nom nom cookies
4 I, ?6 h: S  ^: |        #
/ Y4 v/ u4 i; J" z, {% Y        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

8 F% l2 @+ L4 `+ J( `  q, _4 |. g        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
% t6 r$ d' x" r4 K3 j
        #
        # Tell client that this pre-flight info is valid for 20 days
        #
  n- M1 Q" h" Q1 Q7 R3 p        add_header 'Access-Control-Max-Age' 1728000;
1 f$ u8 J4 w& P4 p' E        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
) H5 |3 }2 M1 X4 c' L    }
- _3 j- J. g, x3 F" Q/ {/ F
    if ($cors = "truepost") {
2 K. ~6 L% C, u& o0 d' U+ Z        add_header 'Access-Control-Allow-Origin' "$http_origin";
0 u9 x2 J! M) j5 V/ r+ F+ i        add_header 'Access-Control-Allow-Credentials' 'true';
( G* f: @3 S: X$ h, B( i        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
+ [1 w* u5 V. K' A
}