Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
$ @5 G: a% N1 D5 N2 r
' }' x+ |. x; S% w

# CORS header support
#
) R+ N  O( [# v( Z; K; }2 t5 S8 K# One way to use this is by placing it into a file called "cors_support"
) K- e$ H  Q; }) M/ B( T& i, \# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
#   include cors_support;
- J* V* K  [9 [# O9 ~! R2 Y#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
0 y. ]& {/ l3 q" Z5 K# allows CORS to work if the backend returns 4xx or 5xx status code.
6 p' _+ Y% ]8 _$ N- i9 A#
# For more information on CORS, please see: http://enable-cors.org/
! ?* `* w0 ~  I- m# Forked from this Gist: https://gist.github.com/michiel/1064640
#

9 {; S) P) p0 U3 |' O9 [# S) _* o$ Dset $cors '';
% T6 {8 x1 R! l9 _0 Y4 G- w( [if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
! _0 l: [, T/ B+ W7 z( O$ ]        set $cors 'true';
% a) w" a( M5 K* t5 n2 a}

if ($cors = 'true') {
/ C; [5 }: J: m$ P/ z" F- w7 Q0 J- s        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
* B. I( f8 W, p        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
$ k2 R0 n" Y/ _  ^        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
% R$ l- f0 _3 G3 B2 l/ K; J        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

5 b6 F% _9 a( W& Lif ($request_method = 'OPTIONS') {
' D9 e; a, G5 r$ w; J: W        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
6 h; Y+ |: `& i& a; Y$ v& Q2 n        add_header 'Content-Type' 'text/plain charset=UTF-8';
; L( E5 l) K( A4 G# F. n8 d* \  d6 s        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
9 A1 U. l: J2 H! b" ?4 I}
set $origin $http_origin;
( R/ I  s% w: K5 B: Rif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
4 `8 w! a2 M6 y) X7 n" [4 S! Q5 P" Hif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
( s+ `4 I. R" M* f     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
$ e# u6 U4 l7 u     add_header Content-Length 0;
     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
6 N1 Q! P2 a+ Y+ c1 y! z) }% _     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
% y7 @: m: r3 \$ b! _     add_header Access-Control-Allow-Credentials true always;
9 L2 {+ v/ M$ P+ |}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
+ E8 {% L/ \  N) m- ^7 K  @( A# Slightly tighter CORS config for nginx
3 F' e( ^# o+ K#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
, M$ @- i) T/ k/ w% p- F#
  h7 C9 R: _& y! ~7 ^  @, _7 [) m# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
! I, U% [5 Q* r; y! @& X$ Y# don't seem to play nicely with this.
! K8 [7 S' G1 {, C#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
% C. o* p6 g8 {" S: D$ |#
* J) _% \% q& I  N7 _. i  i# NB: This relies on the use of the 'Origin' HTTP Header.

location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
/ R* X, p. y$ ], o        set $cors "true";
    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
4 v: T1 E0 ?7 K9 a+ D# A    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
7 L. F: O: n+ K        set $cors "${cors}get";
    }
: L. I' F) c, H; W! d. }- u    if ($request_method = 'POST') {
; T1 ~9 e  P3 ~$ {2 h1 V+ u5 g        set $cors "${cors}post";
; N2 C% o% C5 e$ u# _    }

    if ($cors = "true") {
5 w: Q+ l- c; |; U+ q, G        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
2 ~3 [- C4 ?% M8 I
8 p2 u- ~% o/ m8 z    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
3 ]- D1 Z" ~4 N2 h. T3 E( Q        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
2 g  ?8 g$ `# O: h6 y$ z$ v    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
& d, P6 F: O& Q  i; `2 V5 G
2 W, W) i$ N6 J1 r$ b        #
, q% ]. x+ K" [        # Om nom nom cookies
        #
; R3 W2 `+ E+ ?' J        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
, v3 q! S$ W( d( N
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

& V5 s6 J% p: _. U" H* G3 o        #
( u$ s# c3 S6 f4 ^$ i& g        # Tell client that this pre-flight info is valid for 20 days
9 e" D7 ]7 T& k5 r% S        #
/ j5 Q) j9 ^( p3 o        add_header 'Access-Control-Max-Age' 1728000;
+ Y4 q; G* e& S, C" P8 _        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
( A  W8 _7 P! v" _5 s        return 204;
    }
0 ?$ q$ r, z, {2 e3 c" T
$ O0 u# o$ X( p$ T+ [$ R    if ($cors = "truepost") {
+ Q+ F2 y1 {! J        add_header 'Access-Control-Allow-Origin' "$http_origin";
( G) L0 P, K& I/ h        add_header 'Access-Control-Allow-Credentials' 'true';
# C- G3 P2 _2 P/ X9 B        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
( O% r; V8 O" G% m9 \/ m        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
; R: l$ @& k$ v    }
0 Z: {6 s. B& o* d, q
, [) ]8 E' O; k}

9 N! a% A  b0 F* d. s