Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
2 F8 v" ^; a" e8 w; X0 s, D

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
  L" t! ~3 I# W5 T- L' w) V#
% {6 X! B, i" c, u5 ?9 L3 W3 Q( m#   include cors_support;
9 J6 ]: v0 F- G( i# u; n! o#
+ ]) G% X" ^4 z# |8 y8 f% L# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# `# Q/ u. D9 ]2 ?6 j# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#

* g( p: _0 T3 p0 fset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
% o: m$ \! N: a3 i& h. q! I        set $cors 'true';
}
/ l& }! R& o; \6 r$ S0 b
if ($cors = 'true') {
* W( n1 k% n1 _! ~0 m        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
: V- H! j2 w3 \2 _        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
7 B# M6 M4 v  e8 d( [2 U        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
1 r7 }5 R8 g( _( H, N& |* v; J        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
* U1 r5 ?5 A! f+ T' L% I
! J4 v# f: K! j- L2 oif ($request_method = 'OPTIONS') {
. o' d& X7 U1 J3 z& |2 U' p+ L- g        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
$ u$ J2 Q0 j9 G        add_header 'Content-Type' 'text/plain charset=UTF-8';
( C% N$ \3 |5 H1 o  d1 N& R        add_header 'Content-Length' 0;
) K( a9 L( s! ~1 K. f) l/ z$ s. v* X        return 204;
. o! z6 L. R/ V8 W}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
2 ?- T- V* ^- b* Z}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
5 |* p. p0 ]1 A  J' O: m* A  c     set $origin 'https://default.yourdom.zone';
3 c' i  u, d  o* j  t0 N* Z}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
& F  j4 j8 c' {5 E, H4 h# I     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
; Z: G4 s) v4 R1 S. ~     add_header 'Access-Control-Allow-Credentials' 'true' always;
/ t( c  J: b; w( c     add_header Access-Control-Max-Age 1728000;   #20 days   
7 }) W  ~- f; g- ]! ~1 w     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
}
2 A( B3 L5 `2 _if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
6 ?$ i2 A: F* ^" Q4 P  J2 @! E     add_header Access-Control-Allow-Origin "$origin" always;
7 y. d% w$ ~5 s% J5 i     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
) ^4 {; J  Y3 T2 k0 V6 l7 }# O9 \3 `     add_header Access-Control-Allow-Credentials true always;
$ I7 P& [8 S% J5 Q# Y}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
3 j  |$ J3 R' @#
# Slightly tighter CORS config for nginx
" U" F. C  S6 s1 n5 r#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
+ p; J8 }' H5 h4 t# Despite the W3C guidance suggesting that a list of origins can be passed as part of
* o3 a) \  N$ m# `) M# o- M( q# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
. m% I% T4 ]/ m3 R0 S# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
9 ?' [- t! ?6 `5 X1 U! d# method to control access instead.
- `) I# K7 _8 A, ^) j#
6 f: I2 G4 k7 ^+ D# NB: This relies on the use of the 'Origin' HTTP Header.

location / {
' T* J) W% R2 t) \6 C
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
% B/ ?% [( l! Z- M        set $cors "true";
    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
0 P+ r& |. F, r" i! K( w( s        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
0 c( O0 Z: ]& O. r        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
! M4 F2 p# Z! ?2 M9 K5 o2 T        set $cors "${cors}post";
* h1 G) [8 I/ \0 M0 ~    }
9 ~- X- u0 \; f% F! m/ f8 O
5 E/ f* j& A3 ~* F: r    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
- G; Z. J$ s# l. _. X9 C/ Y( K    }
: \& U( `8 @' D% G2 J( l
  v) p' {/ |. b- g    if ($cors = "trueget") {
( X2 o- C* M( J        add_header 'Access-Control-Allow-Origin' "$http_origin";
; e9 N. \  O  `' Z0 f5 |! ~        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
& p4 ]+ o; f8 T4 g3 o( E    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
/ g+ R9 ~- Y4 {8 \) \
3 N6 V" I% c  y        #
* Z' ^; N5 M( i6 h* l        # Om nom nom cookies
( Q4 {: _! A9 \3 p        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
1 H: Y3 r; f" [
  e+ P) U: i: |' o3 d5 u( ?! A7 X        #
        # Custom headers and headers various browsers *should* be OK with but aren't
! r" z5 P  M: d: v        #
( o2 y, C& P& T- j* y( E! Z* n        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
" v7 Z0 f" T5 j( H3 s( h7 v
; ?' S' P( J% S( _+ L: p        #
( Z3 r- S8 Q0 ]3 V  [9 N! n        # Tell client that this pre-flight info is valid for 20 days
7 X, J4 l* D. e1 v9 S+ G9 H1 o        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
" B- D; t& i, O' L- x' q4 [; c    }

* c2 f' u+ {  p  T7 }/ j1 O* s    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
) ?$ n7 s, k; v5 f        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
1 ~" H7 q& D3 U8 c6 E    }

}

. f. T; i% [, @  o& B8 P