Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:


! L* h& C; W" E) p

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
#   include cors_support;
#
6 f/ _$ ]+ f9 P( v: n  l# A0 M# As of Nginx 1.7.5, add_header supports an "always" parameter which
, h# e: S4 Q0 u" c$ @8 f* ~. q' y# allows CORS to work if the backend returns 4xx or 5xx status code.
#
7 t  R7 r/ O# q7 G! e# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
# B1 Q' H: R7 @! @) u
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
}
0 g4 a; L+ {: ^+ w3 ~# r
if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
) ]. u% k3 u2 Q' \5 V+ r+ r        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
! N9 T* y: L  j: k( `% E        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
+ K  u0 y, c& J3 S+ B$ D# G
if ($request_method = 'OPTIONS') {
$ f3 y" X6 H+ {- s        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
# a  d; `+ r! V) l: J/ q1 v        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
' }3 C& \1 z, d" T5 o7 Q        return 204;
; v+ w! U  }. f: \" @}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
# `0 N* z8 I# v7 ~}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
& [; r; P! T6 O. M     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
" _6 Z; E( l$ x0 |; ^     add_header 'Access-Control-Allow-Credentials' 'true' always;
/ L: [$ X3 e' O     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
/ ]! t8 h: O$ x/ l3 O     add_header Content-Length 0;
: h+ V% g! C  }5 R     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
5 f% ?, \! r0 y* c     add_header Access-Control-Allow-Origin "$origin" always;
2 y* W6 H" X* s$ ~     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
8 G/ Q1 \& B) Y6 z% ]; j; R3 M     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
  {9 C7 T3 X6 A" T- ]     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
9 Y$ n! n$ W! ?: l; N8 J) ?& p#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
, J6 v" @4 I+ B' e7 a+ T' n9 V# Despite the W3C guidance suggesting that a list of origins can be passed as part of
% h1 `' J2 {( ?# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
5 o' J# m8 z$ R! P( D) u, q#
% ~& M" z+ L) c# m8 W# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
& U5 f% M% S. g! A' [# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.
+ O. i1 }5 ]: Z1 ~! e% w$ `
4 @0 m- a8 Y! M- F  S" I, klocation / {
5 O* c1 }' R- V7 @% A" K
8 }! @  h  b, U3 g- G, s  [. x    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
, f1 o6 u' @1 Q  j    }

5 z% [! B' n& L1 l' b6 Q8 j1 z    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
2 V# z0 B) n; ^    # Determine the HTTP request method used
+ Y! b" u9 L5 @2 w& B    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
2 M8 ^( @+ a/ G+ O' o% X- `' i) v    }
1 _0 D* q/ k+ Z; S    if ($request_method = 'POST') {
        set $cors "${cors}post";
$ N7 ?: G3 @! Z8 Q6 q! _    }

8 T3 Z' e: {+ H$ T4 z    if ($cors = "true") {
0 o& I2 M! X; [& A; a( d        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
2 @! z, K1 V% m" O( _# Z) @7 C( ~    }
/ T) @7 C4 u/ N) V6 O5 g" d
    if ($cors = "trueget") {
, f+ s6 \) g% d" u  k6 F/ d. e        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
$ R+ B/ m0 |) l. c/ i        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
5 X; D, D0 M4 _: o; h        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
, z; F+ \3 f# j+ D, G+ g3 y    }

    if ($cors = "trueoptions") {
3 U- n6 j6 ]- p        add_header 'Access-Control-Allow-Origin' "$http_origin";
1 y" H3 z) t3 W* ~1 L' X8 z
        #
/ `& q4 b2 J$ c- R' v/ h- K( a        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
* I2 o$ P1 ]# \' a( i. l/ u4 t
: v) [2 b1 w) A, }; ~        #
1 X$ Q8 E. d# v5 a- k/ K3 m        # Custom headers and headers various browsers *should* be OK with but aren't
# F1 o! v, O/ {        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
) V" {) y" V( ]6 |% o6 Y        # Tell client that this pre-flight info is valid for 20 days
7 U4 ]- b, V" ^! k- h- }- k        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
# s$ ^1 ?" R" _4 t. z        return 204;
    }
! y. C$ `+ J4 w9 J7 b
    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
8 @+ [' g, Q5 I  `' ]1 f! O        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
0 D3 g3 S, K4 {2 Q2 R; d6 ]        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
$ a$ r/ M! m- ]6 l7 N3 |    }

}

' p) p) B( r( a; t