Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
$ K0 ^: |/ I; p* |5 p
% r! A2 m( {) y  V: a( L
3 {) @( y6 i& L5 A8 n: u

# CORS header support
; Q+ ?' G4 U# B6 p9 a% M" X#
# One way to use this is by placing it into a file called "cors_support"
# q; K. L" D, x. t, F4 j5 V# under your Nginx configuration directory and placing the following
' t, D. Z2 E5 q& R! }* ]# statement inside your **location** block(s):
8 w2 e9 D4 l* d8 J#
#   include cors_support;
, z8 a- [: }5 M#
1 }/ f: k, t6 A! |# As of Nginx 1.7.5, add_header supports an "always" parameter which
; Y8 t1 p* C) x2 |8 ?# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
5 h- a  V: F4 @; \8 Z5 t" ]
set $cors '';
7 W) T) P. ?. v% w' A- n3 U$ A* Bif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
! @' k5 J. ^; U* k  q" x' n8 @1 x        set $cors 'true';
}
+ |' H! G( C6 q9 }
5 Q2 G" Z# [$ C9 j* g/ \4 j, Hif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
9 `8 t3 `: [0 T8 j# W9 I        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
( e/ I3 |  }# S" S        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
5 e0 \1 I! w! |% f: w) }
if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
3 L2 S; W7 ^$ g- P        add_header 'Content-Type' 'text/plain charset=UTF-8';
" X1 D9 q$ ~( t' q! j( [1 W% C        add_header 'Content-Length' 0;
        return 204;
2 t  g0 K% Z' ?, Y' z}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
& p: J! q; W& v! o2 @set $origin $http_origin;
4 s1 V) w7 O, y+ i% P# v" }if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
) v0 `5 F2 q& `' m# y) q     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
/ V* N' ?: _! z' _* k& i0 M, P     add_header 'Access-Control-Allow-Credentials' 'true' always;
6 v0 ^) T- G4 [" r( I8 T4 B9 K  T     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
) K9 m2 I5 i1 M! `* n+ d     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
9 ^% |0 L- J( d4 ]     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
8 i2 C/ I) o# [0 ]; ]  E1 j; c     add_header Access-Control-Allow-Credentials true always;
; v1 N- \4 i$ W/ Y5 L}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
4 E' j  C% d) w( B#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
: L% a, r3 J! I7 m) E5 q- ?# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
- p1 q6 R+ I! n: F/ `# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
2 g1 }! q- G. ~# NB: This relies on the use of the 'Origin' HTTP Header.

' ~" }. p+ n, X8 e. n" elocation / {
' Q! c8 d. c8 a& a- h
* r: a: W, R  ]* i; i% d    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
0 N8 R6 z& o/ V! W  ]    }
  R4 m$ U' u; F, p& k
6 r* F) [  s& X: }$ P- C7 p' P# j$ R- q    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
/ T! z* _4 ?. |' v        set $cors "${cors}options";
. Y. o% Y: d8 y5 t+ Z2 }/ }    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
6 Z6 R& B- m( x9 x6 b5 K    if ($request_method = 'POST') {
! n, u1 K; K6 s* F& z& b9 u        set $cors "${cors}post";
( \- w& ?  p3 H/ F! G    }
# T6 z% c8 W9 O% U+ A$ m. n4 u
    if ($cors = "true") {
2 `) r, N' ]5 l7 L3 [8 i        # Catch all incase there's a request method we're not dealing with properly
" }# {) r) _3 Y) ]) Q3 h4 R' ?        add_header 'Access-Control-Allow-Origin' "$http_origin";
2 ]% _! j" k5 K/ L: U: }4 ~4 T$ M( Q5 S    }

    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
* D; r, l# ]9 \- P5 h        add_header 'Access-Control-Allow-Credentials' 'true';
* J* u/ G) a+ Y. o+ I$ n  k        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
  ]/ W7 F( `2 s; q* ]
    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

$ q# ?$ l1 Y* q% x$ L1 `        #
9 |9 O" T$ a, W, Y% u- G" m        # Om nom nom cookies
% |' C  o+ a$ ?$ u0 {$ S; O& u        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
' L% d  h' D. r; K: {- \
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
/ m  n  I  U$ f8 }        #
2 Q) o3 H0 w3 E" T" V' N, A* i+ V        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
        #
  s  G  S6 t" g* ~( X; j* O        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
  V6 q0 a- g. k/ r+ u! w6 j& V! J        add_header 'Content-Length' 0;
3 ]% |$ ^6 Z4 v  @% L2 r: E5 g        return 204;
    }

    if ($cors = "truepost") {
. h, k8 R, P7 u4 C        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
5 v; a. n; B. o1 h1 f4 Q        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
4 ~- M* X7 }& ?8 K; r, w        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
8 i( w" M; Y8 Q$ n/ q    }
9 D* w) @1 ^7 y. [9 m7 R
}

* o$ s* R( r# F+ x0 C9 r" w, O