Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:


; }4 t) j& u8 K: |& T

# CORS header support
- w. R7 j5 r$ b, }# |#
5 s) G$ B7 r! S4 N2 o4 o# t0 L  E/ Y# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
#   include cors_support;
#
8 y1 z7 c3 c* o/ ~; f3 ?# As of Nginx 1.7.5, add_header supports an "always" parameter which
& o, q* S3 c7 w# allows CORS to work if the backend returns 4xx or 5xx status code.
#
+ r* |0 e8 K3 U$ ~/ x# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
; M7 V$ [/ d* W/ ~* D2 r5 f#

5 [9 Q9 H9 u9 U. Qset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
1 y! `( p8 ]) v' E# ]0 f        set $cors 'true';
}

+ r% H* i5 z2 h; m3 y( [6 }! X3 pif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
" `9 p; U$ O) S2 U7 w        add_header 'Access-Control-Allow-Credentials' 'true' always;
4 ^/ x, m$ [. z4 y        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
4 x5 x& n' L3 z5 G$ {  }        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

if ($request_method = 'OPTIONS') {
/ q# w5 w5 p% P+ l6 f. L0 D        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
7 [" _# q' {" [& X- G' F        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
/ ~8 V8 Y- m/ D$ c& W% n

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
8 H+ Y# ?8 g0 p9 t1 G/ l$ wset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
+ M$ [/ ~. s* {9 {5 h7 l4 kif ($request_method = 'OPTIONS') {
, k6 T# _3 R# ?7 F     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
' O0 ^' d% y5 M' H; m* B' I     add_header Content-Length 0;
     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
) ~# k1 i" W! \  t! I- g     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
! M4 g9 y: o  }( E! T0 A#
4 [. i0 M+ F- E7 J7 P4 B' d# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
1 a  g, l- f, r5 e# Despite the W3C guidance suggesting that a list of origins can be passed as part of
. Z. V) N, D6 V6 Z# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
; u. O" H+ m5 [) _# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
2 T# d) x  Q* U# y- u$ u0 e+ x- Q# method to control access instead.
: L" A; U. P' I#
# NB: This relies on the use of the 'Origin' HTTP Header.
3 p; o6 N$ M- }
: v% d  T  z' jlocation / {
' a+ B- Y0 U  ]
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
) Z. s( ]+ f3 @6 E. q        set $cors "true";
$ J- q+ g& \" f! y    }
$ ~" h0 h. i6 V% o& [, ?
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
/ q! _+ W$ g8 [, F    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
  w4 e  P8 \0 m+ e' q. e        set $cors "${cors}get";
    }
3 N9 G6 H8 ^3 i    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }

( t& ?& b' w) m) k+ V    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
: E7 [5 C" l" w. p" t1 d9 W& t        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
" i6 b3 n3 N$ z
    if ($cors = "trueget") {
7 G5 W3 w$ Q; A5 {3 h3 N        add_header 'Access-Control-Allow-Origin' "$http_origin";
) J1 f! J$ m# g+ z        add_header 'Access-Control-Allow-Credentials' 'true';
5 B- R: W( O/ H6 R! F. G( p: G" t        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
5 ?& n6 m1 \/ O) ^: U8 B        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
) T% n! h  n- t( {/ }, W9 M$ p1 a    }

    if ($cors = "trueoptions") {
& @1 r( n4 S* J6 p        add_header 'Access-Control-Allow-Origin' "$http_origin";
5 z( E( }) j) J- E- {
        #
        # Om nom nom cookies
0 x, f# v( A3 ?2 e6 d. t        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
$ g& ~* Q  u8 `, [        # Custom headers and headers various browsers *should* be OK with but aren't
5 o: b/ F' D  ], `3 N* R6 `* F        #
& a2 J$ X' ]' C  s  {        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
: N" R6 `# N. d# J% [3 ?3 c
; g9 M0 F. f  {3 N, v        #
2 H3 M. ^& c& r        # Tell client that this pre-flight info is valid for 20 days
' b  b/ m  C+ i+ t4 T+ t        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
/ [9 i- y8 W0 r; F% S& d& ~5 L- @        return 204;
    }
# [* b7 E2 d) @  N/ _
    if ($cors = "truepost") {
$ j  R1 K5 c5 _8 }        add_header 'Access-Control-Allow-Origin' "$http_origin";
! n( ^- K6 B% |4 E" v        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
9 Z9 o6 O. J8 t# L8 p    }

}

! G* x% Z0 A! y6 B0 M