Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
" p! d& j1 {: q$ e! I+ P

6 W5 K$ J+ o1 f, v/ Y, J! O. e# J9 o8 s

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
/ h8 q7 i, L6 t: e- K$ o# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
* }. F6 \% D* H#
3 m) S5 ]) B1 A( G. t#   include cors_support;
% i+ E! |, P9 Y) B3 t#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
0 Q& R$ w  Q# m; ~#
" h$ n2 K4 d3 M  t3 d# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#

: Q0 ~2 l2 T. n. F& yset $cors '';
! v1 o! {0 p  s: c6 K" ]if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
+ u$ F$ g1 B3 \' o5 {8 h' T5 Z% A}
# h' }1 }. o. r* @7 i2 D( \
if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
, _7 o' r. _- e6 {        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
2 Z: a+ o6 g. l: |2 C        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
& C; b7 [! c$ W: Z* h2 p. G        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
& l2 a$ o/ M& J+ a( m}

if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
( Q# T6 C+ C0 l' o        add_header 'Access-Control-Max-Age' 1728000;
) P; }: S! L) s; }        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
5 X7 E9 B. |0 S8 f- n8 m4 c" p& u* ?set $origin $http_origin;
; u/ H) @* T4 f" fif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
% @0 _& a$ g/ n+ X) \4 d     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
0 F  Q9 y' l: S( }+ a$ X  ?     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
% _1 h" i3 j9 u8 V7 n     add_header 'Access-Control-Allow-Credentials' 'true' always;
+ ?! B6 k5 P; l- M7 I     add_header Access-Control-Max-Age 1728000;   #20 days   
/ Z' H, w4 l7 N  J8 U& d; B) D     add_header Content-Type 'text/plain charset=UTF-8';
8 v# D/ l8 e  b! W  g     add_header Content-Length 0;
# n& O+ ]) j" x, ~     return 204;
}
8 e. S! V$ l: c  }- L& m& A, g4 yif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
& z1 a1 m8 Q4 C  {# x# x     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
#
4 G; i3 C, e5 R7 Q- i# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
' q' l. l: |! ?4 v" Z2 A( M#
% N4 v6 w3 g6 L% f# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
) O6 c: _" H( \& [8 M# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
4 W; |/ ~# R% f, [! [, }' t#
- D! l) c  D/ M' s  e, r' [- X8 T# NB: This relies on the use of the 'Origin' HTTP Header.
! f7 A& q; m- H6 e
location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
) ~7 t% T; e! f6 r3 K9 C/ x% A3 ^        set $cors "true";
    }
  |- ?) w3 t, G1 o8 i. S
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
% _0 K+ h9 n. U& d    # Determine the HTTP request method used
" D; B0 f! N) U9 S: e9 K" a    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
! H! f" e7 [& |3 F- U3 b5 y    }
    if ($request_method = 'GET') {
' E- S; _$ e7 S3 d% J/ J4 A  C1 @        set $cors "${cors}get";
* _0 X- _% `" h: \& J    }
/ X; h6 B) a( V4 d! O4 h% s    if ($request_method = 'POST') {
        set $cors "${cors}post";
6 z  E4 X3 r$ [- f0 {5 {2 {4 Q    }
2 g, K; ^; g7 k- ?7 \
4 x& P! s; n/ `- H* m8 U    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
6 I. c0 z% q3 d& e        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
2 c- C; t: x+ G8 X% ?7 e    }
) V) s9 _9 R! z' |: ~
7 e: H* D1 ^, t4 f' v* S    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
+ O* u0 T- y9 ]! d0 a) F/ w
6 X; m8 b, t( e        #
        # Om nom nom cookies
        #
* R; a6 V* E( R% w        add_header 'Access-Control-Allow-Credentials' 'true';
0 r  b. E0 B/ R, R, H( z4 x1 l        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
8 W, {! ]) }3 A
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
6 h! N; j5 Y6 B4 P6 N        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
' e& s9 W4 {- T* t( w# Y; u* ?
        #
        # Tell client that this pre-flight info is valid for 20 days
" D* }* F8 b9 h' f6 W0 ~9 @6 ?        #
- {6 h" G. g6 y( |        add_header 'Access-Control-Max-Age' 1728000;
/ X: ~; z% @! \. q- y% N" g        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
6 u8 Q- q8 o  M. J1 B) |* v% M        return 204;
    }

    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
7 }) F, H, o4 T5 K2 {        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
) Y1 r5 G# A" ~. k& @1 O& T
* x- q# d. |6 |) u" a2 D# x* Q}

7 z8 W, d5 g/ |# ~" n