Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

1 _- C4 ^4 F( F3 e: ^! r0 K

# CORS header support
#
3 k& V# a1 E+ u5 x9 a& ?# One way to use this is by placing it into a file called "cors_support"
+ b; K" I0 A3 i! E6 e% p$ f7 k8 @# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
6 `: F. [; b$ q* E7 b8 p#
#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
4 \* e! M  ]7 O* b+ }# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
: W, Y* u* X9 @- A% }/ J3 f0 s
set $cors '';
2 K- N, T" I2 ^- ]if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
' s9 K3 a) X2 V/ j6 V5 u& W}

if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
) P/ \3 S2 `( t% \* k3 a) i        add_header 'Access-Control-Allow-Credentials' 'true' always;
  _7 W3 ~* d9 w0 \; g; A- y        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
' h; Q2 Y* P! t        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
% @* _* C  O$ l' ?4 h9 C5 H        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
( T& I4 l* M1 v- @" A
& }$ f" w4 Y$ N( ~5 `; t+ Hif ($request_method = 'OPTIONS') {
6 J/ S0 U  H% u2 V        # Tell client that this pre-flight info is valid for 20 days
) @8 k% q; J' y) s% E1 ^        add_header 'Access-Control-Max-Age' 1728000;
" ~% |! {/ i) w# Q, W        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
. m9 T( L) E$ v6 I

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
/ {" [/ ~2 e; G+ h7 y}
$ I/ q# F8 o  r) q; ~$ n; Xset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
( Z& O+ z4 a& q+ q- h/ m# Z( R}
- ^6 c" e. v5 e# B; O$ Q/ h' yif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
& O5 D2 ?1 R( ?5 m     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
& d. k, Z% k+ r     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
+ n* z9 s4 k) B" I/ z3 i}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
. u8 p5 b/ S( c+ q     add_header Access-Control-Allow-Origin "$origin" always;
5 \/ L. @1 I! K5 G# U     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
; `. L2 k7 S- }6 h4 ~% g9 P; n     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
1 r* N: H4 O1 ~+ R9 |: s8 F% W0 d7 K}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
+ N2 y' n0 {, p; L) a+ R+ o# Slightly tighter CORS config for nginx
, G/ O4 n7 q  O! K( a2 W% L- p#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
. N5 w% H' Q1 L4 j; }#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
$ t* z. X3 t  F: f7 B# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
5 m) R$ @# r' o6 B" V" [% d# don't seem to play nicely with this.
#
, H9 z( n$ L4 K) ~  C# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
; C: a# v; a; e3 h#
9 h* }% I2 I! ^$ c6 A& i7 g" M% d7 Y. F5 N# NB: This relies on the use of the 'Origin' HTTP Header.

% t2 }  y5 @2 G8 f7 C3 Jlocation / {
: O; @# a$ L; w' ?% {
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
; v! \$ ]6 f4 v        set $cors "true";
    }
/ c$ x9 L, b( X# V3 s+ D: x
# l5 V+ v& I' M    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
# q4 X) p% _% B1 a    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
- O( M9 E* }5 O        set $cors "${cors}options";
    }
7 z% t* m7 d6 v1 s; s% T( m* m    if ($request_method = 'GET') {
        set $cors "${cors}get";
7 J3 }) Z. f; X. ?: w+ r1 s2 w: d    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
: P2 |5 K( G  V. U( x3 \+ {    }
& R# B9 a& L; q0 y& u2 t3 D
    if ($cors = "true") {
2 Y) s2 `$ B; P) t, i        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

    if ($cors = "trueget") {
4 ~8 r/ `) P3 }* V        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
9 y) Y9 |1 x7 z7 A% p4 @        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
, `4 Z; `$ n  B$ H- M5 o: Z* V        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
1 t5 O: {& R7 p) u
        #
; {. u! _+ P# h5 v" B        # Om nom nom cookies
4 ]5 T9 j5 u9 \& N( Z4 y0 G3 s        #
        add_header 'Access-Control-Allow-Credentials' 'true';
5 k3 \, s% O4 `  w        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

, h" i: P  @. Q' s, B6 q        #
        # Custom headers and headers various browsers *should* be OK with but aren't
+ X/ A7 V; D1 l, Q* C. a! f% e        #
) c' R! P) [7 p* d5 a+ a0 w5 m- b        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
& E( O4 a' T0 h% t        add_header 'Content-Type' 'text/plain charset=UTF-8';
% E( \- e- z+ i6 Z. T1 E) C7 i        add_header 'Content-Length' 0;
9 M5 O4 t9 W8 ^* B3 X& ]% i        return 204;
/ c: k4 B" F8 \( F. Q( m" G7 }    }

) N& M3 C# }! `% [    if ($cors = "truepost") {
, r2 P8 E0 ^; ~5 D        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
+ i( x- E0 ]# J" }; \        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
& F  j2 u5 g! W9 \    }
$ [& W6 g6 p2 u8 Q  [; `, p
}