Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
3 s: ^8 U6 @, z8 T- c0 `0 u

6 f, [+ X2 b8 P5 ]; A4 o; e2 r: D

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
$ X1 ]( c- c4 i* k" k#   include cors_support;
# r: a; h1 F  P& u! J& c#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
* y# [2 l  y+ ^4 S# allows CORS to work if the backend returns 4xx or 5xx status code.
#
5 Q. c3 h6 x6 V. H; |# For more information on CORS, please see: http://enable-cors.org/
& z( d# C) k: E# Forked from this Gist: https://gist.github.com/michiel/1064640
! _7 ?* p/ |- L9 o! |#
0 V5 K! ~% n7 Q& z- x. |' r6 M* ]' A& w
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
7 x4 s& N& v7 T! q6 }+ B        set $cors 'true';
% c' A1 a/ c0 O. |}

, x# X# A- E' t% L% \' h' l- Vif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
, K" f7 A4 |, P        add_header 'Access-Control-Allow-Credentials' 'true' always;
* ?# ^! H" d6 L! b6 K( v/ P        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
& l0 N! G+ B) l" l. ^. B4 Z( s        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
' K6 j5 H: n8 k- m+ n# [
+ b/ i, d+ C, e1 D! \& ?& vif ($request_method = 'OPTIONS') {
" \. t  q2 W/ k& V1 W. A        # Tell client that this pre-flight info is valid for 20 days
, L2 i. H4 {' Z6 d# p' t        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
- E% i$ k8 m6 E9 e  D* V# \        return 204;
- t. S& e& O, ?}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
5 }+ F7 Z5 w7 Q+ l. Z8 n8 j}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
+ ]) V# o" t5 i( T) r; U& Y     set $origin 'https://default.yourdom.zone';
9 N' h* _- k3 x* H}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
$ I+ J7 O6 G5 A2 Z     add_header Content-Type 'text/plain charset=UTF-8';
0 F# j! U6 N3 n; H: m     add_header Content-Length 0;
     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
2 k" n% ~  O& }% o0 N     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
5 w: s9 M5 U  [     add_header Access-Control-Allow-Credentials true always;
  N9 x4 k4 u; I8 A# q}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
6 M5 p2 V9 l7 @. [; O) N+ V# Slightly tighter CORS config for nginx
#
# v* H$ `( ^/ V; |: E# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
" {5 e( \! R* B! c6 E2 _9 B+ L# Despite the W3C guidance suggesting that a list of origins can be passed as part of
- Y8 D2 c; r4 c- Y# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
+ N4 j) @8 z$ G6 I  h3 ?% ~# T# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
& j5 i2 }# t8 s8 n5 V! P' c2 H3 t#
# NB: This relies on the use of the 'Origin' HTTP Header.
3 p/ m. V, I0 _" |
location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
* W4 [& j4 H# Y" d5 `3 E3 B1 q        set $cors "true";
: ~  {" Y4 ~: o1 ]* g9 S' t    }
1 n8 w' n; G5 {9 O7 o0 f! o
! l, m1 a& T9 u8 _" K: O    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
* Y, h- @; M! s  T, s! _    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
" R9 D3 h4 n* W    }
' g$ Z. U/ h* A% f& g    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }
; J. x* d8 E7 ~9 z$ B2 u3 ^2 s# u
; E$ [% L" w6 L) c& ^: ?1 W8 N    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
9 \  P* q' X/ B' E6 y        add_header 'Access-Control-Allow-Origin' "$http_origin";
+ [% Y% r6 b* I" H6 `    }

    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
' D" y" h) H& L! q9 r9 S6 s        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
1 O+ S! J1 q. N& H
0 i- d6 n5 z, g! V2 S    if ($cors = "trueoptions") {
6 D% o" r2 {9 s- C0 W        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
        # Om nom nom cookies
2 L; M8 i8 a9 [: o- S        #
3 ]/ ]' Q$ l  A" p: [+ M        add_header 'Access-Control-Allow-Credentials' 'true';
$ }8 F5 k# m0 X% m$ [        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
- F- b; w. r! D( q* X
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
6 ~6 t5 c( M/ S' b        #
4 T$ N% N- f9 J  f0 y$ `        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
/ R) a. G. R0 m# d# A        # Tell client that this pre-flight info is valid for 20 days
' L% ~+ j0 |. }- R6 H        #
        add_header 'Access-Control-Max-Age' 1728000;
4 I4 T/ X4 Y7 r: \) N3 s% L; Q9 T        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
2 p& v7 h! y( B/ v) [) |2 j# v    }

: `) {' q' S2 l" n5 [    if ($cors = "truepost") {
$ ?; U/ R% E2 A  R' d7 l        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

}

$ E/ i1 v, J9 w