Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

4 L# w4 D; p5 z& J' ~4 d# _7 [

# CORS header support
#
# x. j- W% _2 R0 I# v$ Z1 V/ J2 N5 ]7 B# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
" b; B9 d; c& x9 {  s# statement inside your **location** block(s):
#
2 C4 |/ m" h# \  L#   include cors_support;
, y" D1 k" b! N#
- i1 z0 [4 J3 U# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
: ~) a& i. N. {' |: Q6 X' e# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
) [4 S( O3 i+ f7 h1 X
( N; N8 c) |2 [* q# v2 `/ Jset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
, F1 z# S. w1 @, L+ U" z, H/ L7 K        set $cors 'true';
% u" K5 A: V! [3 U}
# u% {! f  K! G
2 d+ p% ~4 J$ a' v' A% |if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
# i! W1 E: ^! ~' h# e! I3 u* U, Q8 T5 x        add_header 'Access-Control-Allow-Credentials' 'true' always;
- R4 b% g8 t+ F  V/ p! }        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
5 g3 Q' m- ?0 @' j7 d# O        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
( e' N  V& r" c1 I/ h4 A4 k& K0 b- m
if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
# f3 W# s! U0 i, V* i) \7 d# I% F        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
: g/ y& c+ X- Z5 u}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
) L: t2 ^% s. L& ~}
# T  P1 B. s# W, q7 Xset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
4 I$ H- T2 P, g7 y}
% }& X! N# J+ }# p/ d; Yif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
# Q1 U' {% ]' a4 k     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
& B0 D! ]# |: l! D1 e     return 204;
- Z. N( U8 ^2 i+ m}
! t% q! x  Y+ o6 \: L& E( z) uif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
: q; U/ j) O4 f& `     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
! B( p" f, F" w4 h( S- }; K9 q& x. W, p}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
% [; K1 i4 z, t& h' d" Z#
# Slightly tighter CORS config for nginx
7 L; l. ]  a; [. L. j5 u1 v2 Q#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
- b2 T6 Y( q' ~* L#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
* K  k3 `. k: W% k( ^# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
3 k+ F# k8 ~/ X* A, G. H# method to control access instead.
4 {, s' u% v, G# Q; p#
4 p* l7 m+ ^4 N$ C0 h5 ]# NB: This relies on the use of the 'Origin' HTTP Header.

location / {

! Y0 Q1 Q- o- t" m) }) ^+ }* {) B' c    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
5 y' {6 i! t+ M. e        set $cors "true";
& m+ x. R! y. g3 e    }
# n# N) S4 ~' }3 l
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
9 x' S! a) F; B8 w    # Determine the HTTP request method used
6 j4 [# M; c0 n4 L* G. v) ]$ e    if ($request_method = 'OPTIONS') {
+ n0 Z: j6 I- J, c        set $cors "${cors}options";
# g7 j- E9 ^2 P    }
& f  W& Q# u5 \( f: c( e' d    if ($request_method = 'GET') {
/ y2 _6 `' {* Q  {; x1 r        set $cors "${cors}get";
9 L; S. s1 ~. l6 a9 L    }
: l) d  @& R# T/ N- A# x# N) ~    if ($request_method = 'POST') {
        set $cors "${cors}post";
( W+ r& U: g% P0 k4 z3 n$ U' O    }

    if ($cors = "true") {
# |- C; o. i8 `" \8 _/ J& t        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
) v0 C' n, R! j    }
7 S$ b2 b( x0 `# N& f
" Z& ~5 l6 k0 O, o" \' R    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
! P" q# X- u! L2 h# R5 V7 |        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
; `/ u) x! A3 u+ s6 e% t$ c& s        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

    if ($cors = "trueoptions") {
! d4 i% D# h- c1 t) I        add_header 'Access-Control-Allow-Origin' "$http_origin";
3 K) R4 ~$ A( z2 `, G, w; g
* Y6 L( R/ H2 b0 T8 ~9 `* ]5 N        #
! n$ j5 {) `$ E2 P$ @- L        # Om nom nom cookies
/ g* Q' ?' G, H# Z/ H1 |# n        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
0 q6 H7 r0 B. q. a: G
        #
4 X! E3 W* D6 X5 G3 B        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

( R- E' N" n6 C- ~        #
        # Tell client that this pre-flight info is valid for 20 days
' I& t3 [& D2 G7 \0 G$ Q  W1 K: Y        #
1 V6 ^4 D; |' N. ?+ h# Q: b        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
: L6 ~+ f4 Y9 {2 J7 x        return 204;
    }
' _2 c5 F& N8 n0 q
    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
7 t* V7 O; f4 e# m& z6 {8 M        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

7 }  h% [% d1 h$ d$ _( }, \}

8 }& M+ l  s! H* E, b( ~