Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

2 M. u" M- ~$ q5 d2 b
8 }2 ]$ F5 j& Y0 W3 R+ {

# CORS header support
#
: I5 v8 D+ V/ Y( k4 Q# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
) h9 J1 F' x# q8 c#   include cors_support;
' x1 P* \* j& d3 C* U#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
+ R6 }+ u- m& r" L9 b# I#
7 j, h0 C/ S: b! P% }# For more information on CORS, please see: http://enable-cors.org/
( B9 |6 e( e) _# Forked from this Gist: https://gist.github.com/michiel/1064640
#
& ~- y; V" e! {+ b
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
}
4 o. j/ W% J& r3 X* e8 Y. v
9 R1 \7 ?. N( @; t5 S. m& ?if ($cors = 'true') {
" }* T# K( d  X# _        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
1 C7 e, m0 z/ h" R; l0 l        add_header 'Access-Control-Allow-Credentials' 'true' always;
+ {6 T- E5 ^0 a# S$ a        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
& o" z+ u; h; A5 m        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
, i: H. r- I1 ~% e5 z        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

5 h% ^: F; ~4 K5 s* j. N( G. iif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
0 x& D$ a9 p. _) D( l) R& ~: p        add_header 'Access-Control-Max-Age' 1728000;
4 J) ]; A. x& r0 S7 M' g        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
" i0 B3 i  x  Y& Q) h# e5 R

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
) X  \& O/ g9 z     set $origin 'https://default.yourdom.zone';
  m# O1 f9 X0 U7 q! ^- R}
7 o2 w, h% S. l. ~: X3 gif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
; H! T" V) [+ u* g, c- P     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
  }4 Q6 A) L: M1 b& G8 h( I     add_header Access-Control-Max-Age 1728000;   #20 days   
1 i# E/ a) |) @& H     add_header Content-Type 'text/plain charset=UTF-8';
0 f2 ^! ?2 F- [' \  p$ i     add_header Content-Length 0;
     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
3 A6 P8 A* ]( U4 X     add_header Access-Control-Allow-Origin "$origin" always;
7 z/ ^3 N# _5 ^5 j/ l  u     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
+ i$ p4 q/ y( M# H0 H8 _  b, o$ h8 ~}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
- ]+ @1 |4 k/ w. S# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
  p& ~1 D# C5 f9 f; ?#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
+ i! d! w( M1 N& C6 \8 |7 w# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
- K3 u6 ]2 ^' P: F# NB: This relies on the use of the 'Origin' HTTP Header.

3 R) d- P) K: f8 W+ tlocation / {
' F. n9 G7 ^/ {6 ?9 i; J
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
6 T! Q/ [% I7 `( ]& N" z    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
$ r% V  {( g  F' U2 L    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
. n5 e1 d9 M6 g4 ^$ m    }
7 f. G! V& z4 H5 V% ]9 v
    if ($cors = "true") {
. D) d6 |( d6 B7 h% d" P( I4 B0 e        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
1 {' G2 @: G8 w: {7 ]% J    }

    if ($cors = "trueget") {
/ L% e* c# B3 Y6 m' C3 t; D2 W        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
6 q" q0 Y4 R  V) C9 f        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
  u: z$ ~" C' S" K! `/ ~
    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

/ X* ~; ?: N" ~        #
9 }; m1 G+ t2 C" x* y' S        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
4 J/ O1 S1 S' ?! n2 u
        #
9 w. Z! ~- w) N        # Custom headers and headers various browsers *should* be OK with but aren't
        #
1 e( j' i  t1 R! L        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

/ I) V4 |# j5 \( A  g        #
, h( y' L4 \1 d8 S( H. J        # Tell client that this pre-flight info is valid for 20 days
        #
+ {5 f1 h* M: L! Z        add_header 'Access-Control-Max-Age' 1728000;
) F( n1 Z( p. `  U; H0 {        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
; J, ]6 k5 s0 V* E) |# [' u+ t        return 204;
/ Z$ b7 J9 C/ v1 B: g) f: }. \    }

7 ~) u& m" Q. U: [    if ($cors = "truepost") {
! e' Q" }& w( P        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
' g- o* f8 N% r: b' u% M        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
- Y' R# |( x- x+ U4 |! a. y% f' r; i        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

}

& b) A( H3 S. A0 c4 K* A9 P