Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:


$ t! b5 f' w5 m- X3 h' a3 |

# CORS header support
#
9 T7 m9 `7 ]+ W" d0 y( _. ]$ @, n# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
( `! P4 E1 n# K; b9 ]9 `$ v#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
$ k& `  N; s3 w# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# E; s+ |& ?* d$ M  ?* y& @# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
( Y' j5 h! g/ m) Y# N& f$ ^' H#
$ p' @, |5 X$ d4 J
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
2 P7 [, ]: }- j) f2 |' ?        set $cors 'true';
; y# t) }6 M8 W7 e7 A4 m% d}

. r4 E' d( s. i( _+ cif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
6 B$ Q6 X" t( x        # required to be able to read Authorization header in frontend
/ a+ p/ B$ V# c) N        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
7 t* G7 V0 M& P4 D3 U9 b* D}

# G5 d% d) m+ y, {) vif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
, L9 h2 i, ]. V! L& u8 c        add_header 'Access-Control-Max-Age' 1728000;
( N/ A5 L- `. v6 \. ?1 C8 N  _        add_header 'Content-Type' 'text/plain charset=UTF-8';
! n3 Z, k( E! u- R        add_header 'Content-Length' 0;
3 c  D8 g" q% x0 J, P- U: s        return 204;
8 H& j2 t8 E) T! F/ _4 e}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
6 G0 g1 h; L" Y7 n/ yset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
, L: ~) A0 X: l  X     add_header 'Access-Control-Allow-Origin' "$origin" always;
, F* x4 f7 q) K7 z6 u     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
! u' \4 ]+ \5 t     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
' Y- I1 @8 t' z- ~8 H+ H     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
6 C7 ~% j5 {) n     add_header Content-Type 'text/plain charset=UTF-8';
+ c4 @3 U: N' _6 m! f7 |' c7 N& S     add_header Content-Length 0;
     return 204;
* B7 w' _3 i. l, I}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
; `! M; \/ |) Y/ E7 [& _9 M( Z, `: u     add_header Access-Control-Allow-Origin "$origin" always;
5 T# G' ?4 y: j  a: g$ A1 F( G! [     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
5 Z) P0 K6 F  R9 r7 \0 k. s9 @     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
+ A! e8 X4 Q2 b% ~# j' _5 U# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
4 \  x7 ^3 Y* A! @. u# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# ]& g) i3 o: ~4 b# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
' L6 B0 }9 y2 e& v8 d# don't seem to play nicely with this.
! c" U3 m" I, ?4 y#
  v$ l: A! k/ h4 X/ a# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
" j- ^" e$ C" X# u" e( A# NB: This relies on the use of the 'Origin' HTTP Header.
$ l/ ]: Y# T6 d
location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
. L  ]4 D6 i8 g5 O    }
1 u8 ^: K" U7 j0 F% {# C
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
% d: @9 y2 q3 a0 b: z    # Determine the HTTP request method used
7 {7 H8 [5 d# ^& O3 F    if ($request_method = 'OPTIONS') {
0 w1 ?# u1 a" ^0 A0 c# U& Y3 Y        set $cors "${cors}options";
" y1 U0 E. d) \; h3 U# t    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
% m' [0 W% S% b* h  L. V$ v# `    if ($request_method = 'POST') {
        set $cors "${cors}post";
4 E' O3 C/ H7 O9 v9 M    }

    if ($cors = "true") {
2 l( u% x' s- F# Y1 C        # Catch all incase there's a request method we're not dealing with properly
; b' r, ^( C) X8 H        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
9 r$ V7 d  [3 G, g9 O, X1 A        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
3 k+ S8 q. b/ x; @$ ?        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
- r9 q4 \( j9 A: T# |
& S/ D  x# k5 R" o( x* O0 i    if ($cors = "trueoptions") {
9 \1 I3 m( v9 F* n- B( P/ D7 R% g        add_header 'Access-Control-Allow-Origin' "$http_origin";

# D) J8 Q$ y) Z4 Z        #
        # Om nom nom cookies
. _/ S! I: V1 P* C( \4 V" ~  m        #
6 [7 q7 {& Z; E  l6 D, J        add_header 'Access-Control-Allow-Credentials' 'true';
/ h0 i2 v- S3 j9 W! q+ g        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
( P& c9 ]0 o% `! p
) d+ I# h: l1 t$ R  s/ R        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
0 g( \7 Z7 r8 [2 s: i- ~+ Q        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

7 Y4 k& D' n  U/ v8 }2 b9 I, v        #
9 U* R: O$ _& L+ ?" D2 T) u$ ?  j        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
# y# B: K/ u5 ?$ p        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
) Q' e$ u8 a* f. l- s2 `        return 204;
* A  C3 n, \* x    }
: }  g. H9 x. X/ o
3 s0 i+ n# b0 ?; |# Z  Q% G    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
; W/ y( J1 }3 E% ~        add_header 'Access-Control-Allow-Credentials' 'true';
; b1 ^. l3 Y# H$ o. z- u# |        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
2 r4 P7 _/ a& i: C2 [$ x* B        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
- r2 u$ h' i6 K- b    }

}

* E! X2 B. [0 z0 C