Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
! y7 C7 l5 m# P4 Y5 ~6 j+ H1 y& m4 g

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
; n+ x% P  x, a9 f; w#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
# x+ n: M' v# f1 |#
* n# o! l0 G/ R- S8 e2 s: m- Z# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
* X; q5 M# J% x1 G" v#
9 m% T; ]5 {" u8 A$ ?
/ @1 r+ h$ T* wset $cors '';
/ R" q% ]6 |4 \; g- y: y0 x+ ]if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
) M( j4 g- [4 A4 U3 C1 E5 i}
2 ~6 v! {% N' F& f+ Q2 x* X
if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
& |- x4 f9 n9 t8 t1 H) b7 C6 o! O        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
. l( K0 O3 y4 T! q* g
if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
, @) e4 U2 t3 L8 O* k6 O        add_header 'Access-Control-Max-Age' 1728000;
- J5 Q, t. S' F( ^        add_header 'Content-Type' 'text/plain charset=UTF-8';
- [3 _+ B1 X0 @' t0 _- _        add_header 'Content-Length' 0;
# x3 Q" l$ P: g6 S' b        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
, T1 w7 s# v4 J

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
1 q5 W5 s/ R' P! X: X) a! Z% N}
1 t+ R2 d. ^* s& o1 n/ S1 Hset $origin $http_origin;
5 }# X3 y7 b3 {/ A: h6 P% dif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
2 u. M- N( F. c3 ?6 |' _0 w% R     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
$ Q7 H. |6 T1 f$ }% B     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
, k" P& b  v/ A( ~8 A* @     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
4 t1 ]! \7 X* t     add_header Access-Control-Max-Age 1728000;   #20 days   
1 c( W( n0 q! v0 f5 A( e$ ~     add_header Content-Type 'text/plain charset=UTF-8';
6 c# S1 L. B2 J8 ~2 i, W8 ]     add_header Content-Length 0;
     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
( C* Z% N; ?) m$ S3 g0 c- ^8 K3 e     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
# G) ]3 q; U# I* H, M; Y% q8 }6 E}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
#
( h5 m* B  R' F7 A7 L4 M$ [# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
! g. Z3 C0 J( G* ?9 Q#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
5 u" b0 w$ x$ H# n7 t# W# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
% ~" b. e  O. F' C+ ^# don't seem to play nicely with this.
$ }. _- r$ i, Y# N1 e5 a' O#
8 j+ ^2 j$ y# |; y9 a# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
2 W5 d; }: ~1 x# y  M# method to control access instead.
4 u# w% e3 I0 T; Z  c8 o! d* O+ }#
# NB: This relies on the use of the 'Origin' HTTP Header.

location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
( \( |3 N4 _. N, h$ L3 \5 P: Q        set $cors "true";
    }
: z; M' p1 y1 d8 ?$ e$ |5 C# Y0 D' [
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
# x6 w% X  [7 A3 \# p) }6 C        set $cors "${cors}options";
' J" e0 i9 M5 `, h% _& L    }
    if ($request_method = 'GET') {
$ d6 E$ ^* e! A+ B        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
* h" u( L& I3 m% }  v  f/ E    }
# X/ Y2 o4 t9 y7 T& j
0 D5 C$ N- ?+ y8 q1 c# r9 ?+ \% e( R    if ($cors = "true") {
' l0 K3 n! s6 g: I8 L( \! J, S        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
; X4 j- z1 A- }' u6 Y* ~        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
% {' J' Q) B2 @: I. S- X
  F( G4 R( F% h7 f7 G9 E" F* T    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
        # Om nom nom cookies
9 E# C2 B* E5 ~/ a5 P' h        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

* x. i' H7 s$ y+ W; [7 i; I! A        #
        # Custom headers and headers various browsers *should* be OK with but aren't
* B0 d! ~8 D! B4 ~* {        #
5 s/ a/ O5 m; M( G  {* q0 Y        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+ p9 T( _& ^0 u" ^/ X( o
        #
. `2 |- K+ B3 I* Y; r+ n        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
! e( K# T4 q. h5 b        add_header 'Content-Type' 'text/plain charset=UTF-8';
& [- n# ^8 C/ w5 I! w        add_header 'Content-Length' 0;
8 d0 S  t: R; A& e. X' x4 x! g( S        return 204;
    }
) p% E" q1 P: _; m) F) H1 U2 r9 K1 c2 w
    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
/ M% C( [; p- @) _7 ^  y3 [7 z3 |        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
7 C# a% d) h+ l- w' Q        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

5 {/ C+ S( g( q7 y9 I: l2 ^}