Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
; Y7 x2 Y# `8 y+ @. E4 K# \! r
) Y! n2 G. u" y9 t0 T8 v8 a: j
# M; D! _& ], G3 w

# CORS header support
& w" `; `- y  D" Y# y#
! ?: B5 A; b& A2 Q; Z( g# One way to use this is by placing it into a file called "cors_support"
3 D1 O; O! J7 ~3 F: g3 [# under your Nginx configuration directory and placing the following
- B% Y# r4 m& P4 Y# statement inside your **location** block(s):
#
( E( t# t0 ]' ~: K- R; t  p2 \#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
! c8 K& a- F! M$ }' u) H/ O#

. Y4 C6 l1 U5 A: p+ B# Nset $cors '';
8 C, n% h7 ]; V9 U+ Nif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
) T; L# P0 a& q, C$ q* p( Q6 P        set $cors 'true';
}

* M4 i8 L# n9 c6 fif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
: _' \6 {8 M) q        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
- F: ^& [* V" p1 d6 d$ S" Y9 j        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
# c8 E% u+ r8 Y! r        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
, {* \7 @( \# b% R4 n" ~6 j0 y; x     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
/ H" h% }: a- i0 {" s2 n     add_header 'Access-Control-Allow-Origin' "$origin" always;
4 i( q! g: K1 J     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
5 C" ?7 s" L1 Y4 ~/ P     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
* e4 s. k2 o7 Q6 T% g* y; d     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
) A2 ^4 N( ?. \5 p- n( s5 |     return 204;
. F0 h5 w0 ~% W' D% h}
8 M6 I$ Z7 v, Vif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
( |: N+ q: M2 y/ n* V5 N     add_header Access-Control-Allow-Credentials true always;
4 {4 c: O. K' b5 s}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
8 z6 {/ J: P' g( S7 ?. ]#
" C) s  L4 |) I# \( V# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
4 N( i" }  n4 k( V- I4 g( s* d9 W#
3 L7 P$ Z; A( E# Despite the W3C guidance suggesting that a list of origins can be passed as part of
6 E. X" {3 X7 w% H1 J! Y6 @# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
8 L3 ]+ p3 n! A# F3 D. H# don't seem to play nicely with this.
#
% t& k5 ?5 N$ d# g# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
* Y+ t- x: w) ~7 p. O# method to control access instead.
#
* L' g2 w9 Y) ^* V& x' k) T# NB: This relies on the use of the 'Origin' HTTP Header.

location / {
- a" X- _+ [" L
5 F- o% U7 k; o7 H  J5 f/ e    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
6 g1 M, e8 W( k7 Z# ]1 D( t        set $cors "true";
    }
3 i* v( E) h$ U8 Z" ]
& Q5 ~' A. w& F+ A1 x9 P* ?    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
( t( i/ J, p! X9 s    if ($request_method = 'OPTIONS') {
& Q4 c7 O3 y1 T6 X% v: @, o        set $cors "${cors}options";
    }
2 }( U2 \1 W8 y    if ($request_method = 'GET') {
        set $cors "${cors}get";
" F( _4 G, x. {+ H    }
( G$ a% t, q% A8 n! ~    if ($request_method = 'POST') {
        set $cors "${cors}post";
) @3 o! t/ z( a* Q    }
+ }; q( }- A: E$ g
4 V6 }9 P8 Y; P, I    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
8 ~  O5 E9 k6 ~4 V: Y  P/ y+ t
5 E! |: D+ Z1 v0 b. Q3 @4 z    if ($cors = "trueget") {
: p6 S9 u( b) _" H        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
: x. }; U1 l; }, E5 t* b7 ~        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
, _9 m1 A1 r) S( |3 s
    if ($cors = "trueoptions") {
$ p5 q* l" f* t( y' V4 T9 `( v: I        add_header 'Access-Control-Allow-Origin' "$http_origin";
# c" G, W) v/ l; E6 `
) I* a/ f; d: W" b        #
* s4 b# Z8 l3 j        # Om nom nom cookies
( P2 H( j6 D, S: \        #
        add_header 'Access-Control-Allow-Credentials' 'true';
6 \2 Y2 H$ L; L        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

9 c+ C/ Y" k! k  k, c        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
2 G/ W" F+ t- v" E2 E1 z) L        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

5 M( }- Z6 p0 y; M* b3 m9 G: q0 c  g        #
! ?6 G/ m, u" L' A3 i* s( u        # Tell client that this pre-flight info is valid for 20 days
$ E0 }) f7 F1 C$ q6 z4 h$ B/ I        #
        add_header 'Access-Control-Max-Age' 1728000;
; o' d5 O# _3 I5 y$ F        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
: O# T1 f- D* c. @1 D    }
3 L( E9 V) |( o# ~" {' ^& w$ ^& [
    if ($cors = "truepost") {
. \4 R3 p4 m5 M: q  u! O, f: t        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
  L) M3 f  X( W. ^. |/ P        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

4 `/ I2 a: ^5 H5 C& z}

' \8 w1 N/ z1 y" Z: F
" Q8 G1 e* w) }