Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
1 S. r/ [1 _6 n1 i

# CORS header support
#
( E/ U# d1 x/ @1 Y6 f  r! S0 J# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
) ]9 U; G; |4 H" k) \8 }8 Z#
  }* a. J9 c. P5 C: u  c2 g. k1 C2 ~#   include cors_support;
2 w7 a8 o& ?; q; c#
7 O- V, Q: e4 e- N7 n+ r/ u1 `# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
8 W% G0 l( C+ v% w, d% z$ C+ K# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
# \4 l# t7 Y- F" I0 O3 B5 M: x
* C& A3 s( p6 |# ]7 K. Z: \set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
1 W: X' c) U1 _4 g* I$ t* ^        set $cors 'true';
6 c# |( A) `* {5 S}
* Q: E3 Z) e, o1 M, I3 K4 \1 K
! ~4 r" {- {% Q, x3 h5 ~, M" Qif ($cors = 'true') {
( A; S7 D2 V' x9 I" Z6 {1 e* c        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
# g. j- H, x. B0 u* J% ]* ]        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
/ P" z+ Z9 S/ F2 J, s        # required to be able to read Authorization header in frontend
+ D6 P0 |0 m( x' n( X        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
" q3 \7 l4 y, l; T, ~# v
if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
! N3 J6 e, B( K3 `0 D) E        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
5 X$ c3 W- G/ B- F7 Q        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
1 q& y5 _4 b! g9 P+ f) c3 p6 u}
7 o0 G) t1 Y7 y4 I. R/ wset $origin $http_origin;
# |. l; u. l/ g/ i8 T$ Wif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
9 x9 k& U3 z0 u, m' i     set $origin 'https://default.yourdom.zone';
8 Y# Z! U+ F" j8 K# ?}
+ j7 g& N. q, }, ^( I5 Iif ($request_method = 'OPTIONS') {
- S+ r* n6 ?) y     add_header 'Access-Control-Allow-Origin' "$origin" always;
+ v  Z4 I7 Z* A" N) m     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
0 [' h0 ]7 H! V; {9 ?6 W1 N! @1 U     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
( H, O( E. e" Z' Z- F     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
& |5 w3 s. X% U, J     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
! Y/ K9 F: p- {     return 204;
& p& U; u: {# u: B5 `4 l& e}
5 ]: q3 ]3 A; {( H/ J6 H" Vif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
9 w- z# z$ E1 H" M5 B! j# ~% x     add_header Access-Control-Allow-Origin "$origin" always;
, B: _7 b9 W1 l6 a' B. H: `. I     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
7 U. [, O* d2 m' g     add_header Access-Control-Allow-Credentials true always;
* s% S, b/ k! X2 |}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
! ~# b6 X  x  f9 }#
: g, N3 r0 _' s, n; a3 c8 t# Slightly tighter CORS config for nginx
7 E& n* U; c7 u& m#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
7 F; x. M1 s, ^  Y7 T' `/ k#
, Z  N. \& Q2 n9 Q8 Y# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
) N% X6 ]- |  O  k# don't seem to play nicely with this.
#
2 Q: t" B& d& f# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
' C) y- p* A# F& N8 s0 t# method to control access instead.
1 A5 z/ B0 P7 N* i$ {9 ?#
# NB: This relies on the use of the 'Origin' HTTP Header.

location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
, t8 P/ c  H2 w; E( A& J( Z    }
0 H) N+ B/ W& z
7 B% n+ _6 ]6 u' u1 k6 {9 A- j    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
& k" x2 s/ m& b; y# L    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
3 P8 T1 Y, z6 j( G    if ($request_method = 'GET') {
/ L. g  t  a' v. s1 s9 `( Z% Q        set $cors "${cors}get";
$ z+ v& |2 u+ i1 m3 k) r, G& s    }
    if ($request_method = 'POST') {
8 c$ \. y( i$ O* \* @& O        set $cors "${cors}post";
    }
  `: r8 s1 E/ @2 x5 _1 {) ?9 u
    if ($cors = "true") {
5 }- W" ~$ A0 B, [5 W- ]5 q        # Catch all incase there's a request method we're not dealing with properly
3 S7 @, ~/ {# g; D5 }        add_header 'Access-Control-Allow-Origin' "$http_origin";
$ G# k& U; T& {/ f    }

    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
9 U4 c: F+ N* r4 C( {        add_header 'Access-Control-Allow-Credentials' 'true';
- P$ c# @/ u7 i        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
% v! f( v. h! M) l/ o        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

$ y9 Z) I7 t1 O4 p$ O; d4 W    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
        # Om nom nom cookies
% ^5 ?/ p% w, ]* g* d        #
        add_header 'Access-Control-Allow-Credentials' 'true';
% h0 |6 G0 y) ~, X7 l* `2 s        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
        # Custom headers and headers various browsers *should* be OK with but aren't
( _( r( k3 ]/ X+ `6 E1 Q        #
* a! @9 U" q6 o8 n5 y* e        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
        #
, ^1 R' z% k! D* m% ~        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
    }
9 _  d% Y6 j) }2 i
+ m/ K; W& _' v/ O* i  P    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
' n: ]& C: E. u( T- g! J        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
$ a# O8 K- M0 ^7 |% X0 d. `, l$ u
}

! m1 F2 x+ J4 ~$ N. z; a( t  O& {
' q) g7 R0 m* b# V, a0 D