Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
+ t+ d7 w/ R7 t# D/ s
0 g7 i0 Z$ E' h  G+ C* H5 ^

# CORS header support
/ F' P+ Z: e- e, P& L: L. m#
6 N0 ^6 C# N4 f. `$ B; G0 p# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
8 ^' ]* k7 U! _. \# statement inside your **location** block(s):
% n# r' _+ k+ n4 v5 V0 m#
1 \/ j1 G5 B  R#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
  |; i* ^* W. I/ d; p! i#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
" i4 o4 S+ g9 w! Q& h" x- O. p! M$ B#
( O2 u. H* |7 \, K4 y6 f& O* `& I
set $cors '';
) L' |% S* U; a4 z5 yif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
" Y& `: u1 }6 ^4 m}

! {7 h: v0 F0 jif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
$ c  |. ^- n' X* N) {" T        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
6 j: m2 U. j6 \        # required to be able to read Authorization header in frontend
: U; t0 I: Y! t0 |! {        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

if ($request_method = 'OPTIONS') {
1 K6 q2 H% o7 o" k0 z. P        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
: B5 U- O  b3 U: J. l        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
' H3 W+ Z+ ~# n" n: P        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
& J5 Z/ ]5 [. H- N

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
  h- ?. W* k- Z. S/ xif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
, n; _) Y. ^! R2 o' V}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
: P( [$ F4 O: g8 A% C8 D     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
3 [2 x; a% p0 s4 s) P     add_header Content-Type 'text/plain charset=UTF-8';
- M# R, ~( r0 {+ U" n( z( p     add_header Content-Length 0;
5 b# |; a& I3 R: j7 p1 O" W; p     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
3 I" l) X* N' Q% M     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
# k" H0 w( l$ f# t# t1 ~9 Z}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
% N" B3 w# K( @. x% V2 D# Slightly tighter CORS config for nginx
  x) U2 T2 W( X5 L8 ]$ h, v- V- M#
9 ]" a  L) C% j& }7 w4 Y% U4 T# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
7 s& }- Y' t5 Q. p5 H. a* ~6 [: P#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
! _# S8 i1 h8 m  L8 L  X) A# don't seem to play nicely with this.
# @" |; w' L8 z/ }, [#
9 M  t5 M* D! u6 D4 \# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
& H$ p# d5 j% C! {. v: d) ^  K# method to control access instead.
5 W& S8 \9 |. @4 D# R#
# NB: This relies on the use of the 'Origin' HTTP Header.

$ F! t+ f  C) l, Qlocation / {
3 I# `& u% i5 I2 V* U
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
7 b$ B2 V5 w# p% r# j: ?* L+ D1 N    }
1 h' y( B: {- D0 X4 _' ?: I
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }
" D6 ~2 e: l: h1 J% c
" E! K6 ^$ R2 ]* m6 u; ~    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
9 L& C. n/ B% D" N' U' `    }
1 o! ?6 g' q1 q
    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
) b$ q; R7 ^7 \# D( u+ k4 N7 h        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
" m$ L# B! @. z0 e( f        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
. Y' S0 D3 E- |        # Om nom nom cookies
        #
' e+ {6 [2 m! O& B; Y        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
1 A. z+ v9 T# e/ h        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
# X3 V- _3 J; }5 z4 H        add_header 'Content-Type' 'text/plain charset=UTF-8';
# Y  Z2 Q1 `2 D# d* m        add_header 'Content-Length' 0;
        return 204;
1 D, K9 S8 P1 d( l( C& a( J; v( g5 W    }

    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
2 l3 |& z. Z6 n+ F8 o0 a        add_header 'Access-Control-Allow-Credentials' 'true';
0 y. \9 D% [; o/ m4 z/ u" H) Q; }        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
* |1 H# \9 b5 j( ]/ f        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
; j; R5 G" _& @/ G! G    }

}

7 s: c7 e' G0 [# V