Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
& P1 o: }4 M& u" W8 Y( D' L
  Y5 y$ F' c( H- h

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
, N5 D- Z4 g9 t6 D# statement inside your **location** block(s):
; g  N9 E" p; P* J1 l$ v: s#
0 |# K" z0 c7 [) y3 o$ v, |#   include cors_support;
0 ?% N4 D+ ~3 M- n#
1 i6 X* [5 i$ P4 c( {# As of Nginx 1.7.5, add_header supports an "always" parameter which
0 H; |$ v2 Y9 w3 ?' D# allows CORS to work if the backend returns 4xx or 5xx status code.
4 w! v: P4 s, Y#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
0 z6 U2 o& ^" T( a0 i. A3 C& Z2 D% Z
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
& |; w% c% x" i& E2 F" ?}
- p1 d$ L; l: j) f- T  B
if ($cors = 'true') {
1 X$ x1 v, H9 b% r, \, S+ b- g        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
, a& Q. H3 Z& i( ?# h, i3 }( w; z  l        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
' K' U6 @/ y' e) E4 w        add_header 'Access-Control-Max-Age' 1728000;
5 ]" ~) E1 ?5 o& V! n; ]        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
1 A" |# p4 ]9 X

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
% y1 r3 b4 I+ P# H9 L3 L  p}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
. S# b# i( @$ X0 r9 C     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
7 H. G; C3 u  D) L     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
, R. A3 N, {/ @% @  B& F' _     add_header Content-Length 0;
     return 204;
! f. p  Z8 G( {/ E- X' [}
# Q8 {$ }" F! J9 vif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
. m; F+ U, L  k1 g     add_header Access-Control-Allow-Credentials true always;
& l  |( ]1 q& ?; ]+ x/ f/ O# a}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
! o5 l7 I. l4 P' E1 A% S5 K#
% W' S: X+ [$ r& |8 D8 A1 \# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
- Z8 q+ V( }6 _( K0 B: N& p1 _# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# t6 o3 Y+ L8 U: e4 C# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
( i, a$ h# T2 o" W- Q: |: `# don't seem to play nicely with this.
. C. D0 Y6 l/ I6 h  n2 ]$ J! W#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
9 q6 D9 p- ~' V: E( d2 o#
7 _2 P$ f9 V* G5 Z# m# c$ V) T# NB: This relies on the use of the 'Origin' HTTP Header.

location / {

! ]" z- [/ g2 r  n# h3 F    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }

3 h8 P: d0 E, Z! \1 h9 S2 z; a    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
, C7 q7 B1 d* ]4 b' P    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
6 N1 ?6 _- c7 |" F- t2 T    }
6 S3 L' ~3 Z1 x1 @* Y& X: U    if ($request_method = 'GET') {
7 F) Q/ k$ Q/ k  k/ |  t        set $cors "${cors}get";
  ~7 M" [& g. F- r: {8 u3 e    }
$ T6 E5 y) L; S9 c- Z( T    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }
' s; W0 Z( b. u  A2 P- l
. W7 n. q+ B  }; t" x    if ($cors = "true") {
( S5 u. X$ ^! u' p/ R        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
+ p; h" _2 Q6 ~; h2 M* O, d    }

. W& _1 F1 Q; K! W5 w; }2 ^$ y! ?2 S    if ($cors = "trueget") {
# a) E3 s9 c+ |$ A        add_header 'Access-Control-Allow-Origin' "$http_origin";
; O' r/ S$ I& Q, t% N        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
8 ?2 O" S$ y5 D5 D        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
) ?9 i, r: M2 z) f! r    }

    if ($cors = "trueoptions") {
* F& r) v5 `9 T        add_header 'Access-Control-Allow-Origin' "$http_origin";

8 x, E6 j+ E4 v2 P  K4 O% _        #
. q8 _" ]& X2 E        # Om nom nom cookies
  a7 _) G. U5 c9 ~        #
        add_header 'Access-Control-Allow-Credentials' 'true';
/ N+ |3 {/ w# N/ K- ?        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
) o0 j4 u2 s: T% H        # Custom headers and headers various browsers *should* be OK with but aren't
        #
/ r9 B0 N/ m3 Q$ q$ {: i' j        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
$ Y1 V2 I3 T$ p5 h* S
( p, o, Y5 t% U" H) L        #
! D3 q" f1 k3 N" b2 Y& F        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
4 m% i6 U+ _) G% c        return 204;
    }

$ j, l2 w& l$ Z: ?' u( \5 W% e    if ($cors = "truepost") {
+ h; c  T6 r" O3 \0 F9 D6 r; y! ?        add_header 'Access-Control-Allow-Origin' "$http_origin";
! I7 F, |2 j) Q5 u5 I: Z        add_header 'Access-Control-Allow-Credentials' 'true';
  J4 Y. y+ A  n* L, z( q( b        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
7 y8 T+ z. K/ w) J* N$ H7 G' r        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
) k6 C- |! m9 G( D  T* o    }

7 G% O0 @/ _0 a2 S}

. l  g' _4 \  |( B- N
/ F- l6 O) h5 C+ V8 ]2 X/ e+ p( l