Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
: b( n% g: j& x0 p9 D

! {; `7 k1 g& a* G

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
% L) C1 W( I/ ?& n# under your Nginx configuration directory and placing the following
! ?- n$ I# r" M: K6 u# statement inside your **location** block(s):
#
/ Y0 o2 ~6 ]* G1 O2 {#   include cors_support;
( @) t4 |. K9 G1 e$ g7 v#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
+ t; \7 P- h6 ]( x. S# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
0 D9 d, l* @, m1 i, @
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
" w3 A. |3 A; Q! @/ B) r        set $cors 'true';
& X! P1 ?- C  L- W6 r}

. _& N" l( p# A5 g0 w3 Jif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
1 M0 K& ~9 o, R+ m: t# j* h2 c" \        add_header 'Access-Control-Allow-Credentials' 'true' always;
( m" X! B7 i  u: `3 d, ^# |  _4 D/ [. |        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
, K# c3 w5 P3 o5 w        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
4 ]' a0 `6 a! d$ k. R}
& A9 g/ Q$ {9 Y. v5 U
$ s: a& }8 _0 L+ Pif ($request_method = 'OPTIONS') {
" X# L1 _/ |1 d5 f        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
$ f8 X% Z. n7 L9 ^        add_header 'Content-Type' 'text/plain charset=UTF-8';
) Z  ^2 H( O) H+ u        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
& c9 I6 q6 N: V4 xset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
: v( ~: f% V* O; E) l}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
- d% B2 j8 [9 u     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
1 A$ n; L' L# n' u& [     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
$ m! j/ S- c8 p2 v}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
$ s8 ?) Z! g% S- Q8 e9 P     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
, [3 o5 _2 _4 u; D1 q  M1 Y& R* D# I     add_header Access-Control-Allow-Credentials true always;
2 R: a6 Z! B/ i- b; M}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
+ o6 ~- U$ Y; o  _8 h#
# Slightly tighter CORS config for nginx
0 c2 y/ w8 U9 [0 h#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
9 b1 _, [, b% [2 U#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
  w! P+ i7 f: X/ P6 O# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.

( w; R  d1 o3 i2 n5 o/ s, S6 Ulocation / {
# V! \4 p: r( |; F! j% u: J
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
" ]  P9 F( l) e6 m5 r' B* m2 S
) A- I+ t" Y- P& |    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
* y. ?0 x- h0 u6 x4 T    # Determine the HTTP request method used
: B1 A9 t' n9 I' v0 c. f    if ($request_method = 'OPTIONS') {
3 c6 @. W1 r( q, G4 u: s! B        set $cors "${cors}options";
7 \, ?6 T3 ~0 h- U1 |/ y$ _8 H7 ~    }
" w/ Z5 \2 O" F, a8 e    if ($request_method = 'GET') {
0 s, I$ c( G$ L$ @        set $cors "${cors}get";
    }
$ Y, `6 E% R& X. y1 u    if ($request_method = 'POST') {
) x* K  [" V  s: M, b/ n        set $cors "${cors}post";
    }

    if ($cors = "true") {
1 f. F' M6 P8 v1 {3 O' X        # Catch all incase there's a request method we're not dealing with properly
% J& U* b2 l. A; U$ e( x1 F        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

1 n5 \$ I$ y( T/ n    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
2 C9 J7 C, G* E; l; S        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

0 A; o( }5 k% `4 s8 \. \    if ($cors = "trueoptions") {
9 ]5 u! k; b) F& Q) {9 ?" r. ~2 I        add_header 'Access-Control-Allow-Origin' "$http_origin";
5 d0 F9 x8 @' e8 [6 r: E& Y& B
        #
        # Om nom nom cookies
# d/ ?/ s$ r" ^        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

' Q, Y: |5 b! X. Y2 D4 A        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
4 U" d  C2 `% O        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
. ^2 A# i& u' w0 k1 }. G( S! ^! M8 O        #
( [1 w9 ^. z- Y; ~- O        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
# D8 `4 `7 R' k        add_header 'Content-Length' 0;
3 q# l' E- M* |, o& m        return 204;
8 o( F- D# L  N9 ^    }
5 g3 h0 ~2 O% Q. n/ S7 O' l) A* p
    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
, z+ e' E0 H0 f: K& S8 K$ v        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
$ {1 T/ o  E4 m$ Y8 u        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
: R. Y6 `* X. i3 p! {    }
* u0 f: V+ p: M8 {: |
}

" d$ m0 z; G" g* w  f