Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:


9 ]" M& y# |% l4 b8 Y8 u

# CORS header support
1 ~1 ?' f5 t  M9 [#
, d3 L; ~9 P; b/ G5 K" m; o% `# One way to use this is by placing it into a file called "cors_support"
  m6 J% a/ Z  C  ~# under your Nginx configuration directory and placing the following
, S" j$ c/ `) W1 n* I% w( \# statement inside your **location** block(s):
#
#   include cors_support;
# K# z5 N, I" C9 e#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
" N# n( o, C6 M) M: T( }$ U; Z! ?8 J# allows CORS to work if the backend returns 4xx or 5xx status code.
#
" [1 t0 f1 v$ j+ V# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
. ~; N! E; n/ Y3 k2 i#
. g7 A* L+ A5 g! Q6 @% U6 h" T% _
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
4 \" a; B9 a, r2 t0 W0 r8 h        set $cors 'true';
}

if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
1 }; x- @( E. H5 K& B! U        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
5 O6 D9 t, D: J7 @5 P' t9 V* q2 @        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
$ \  P  W  W5 o8 H4 X9 y+ d
  ?# @7 F! ~: W+ {: l" bif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
# Q4 ~* x$ n9 R) z" t        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
' ^7 V7 W+ M6 u' y( Q- R$ a        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
  U' F9 `9 i8 Y  }/ N

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
$ U( x2 _0 B( vset $origin $http_origin;
* _" P" ]0 y+ L* Gif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
4 q& v( K" k: b3 E+ z     set $origin 'https://default.yourdom.zone';
}
% ]% z7 P, _% P) r# Oif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
( g0 o: G% I+ m9 C- J     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
: m! Q; {0 s) r7 c. e     add_header Access-Control-Max-Age 1728000;   #20 days   
4 g# D3 c, {. v* _     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
$ N2 \8 Y, @5 G}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
6 c$ g, C# c- T/ V4 v2 O& D" z     add_header Access-Control-Allow-Origin "$origin" always;
( x9 T. x/ Y( n     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
! q, S8 C; f8 l5 U4 P2 }     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
3 d% p% L0 ?. r& x7 `- D     add_header Access-Control-Allow-Credentials true always;
; p' f: m  C+ j' |}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
#
3 K% h; t. Q& _5 y9 O& J$ r0 Z# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
0 l+ @2 O9 b9 Z5 U0 K. R" H- n#
& O2 I4 i. n  J* v" {. v, o# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
$ r# |/ D  S: E" j: D( ~# don't seem to play nicely with this.
" k3 `3 R# L2 W& I+ k#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
( y& }, L* q4 I2 {1 f2 f# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.
/ N0 D+ x( v, n: f# h) B
location / {
6 |' t$ g) F4 E9 M, q
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
/ e5 _& V- w" @8 y    }

: ]3 E+ e* Y; [* M' ~$ [    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
" E8 I" Z- U, Z4 C        set $cors "${cors}options";
0 g) S6 `  e0 s- t    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
2 V  N, M9 j) H( O& D+ M1 u2 J    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
# N& i* `; M# y* E, m, X    }
3 h/ K* e. k4 D4 _) J
    if ($cors = "true") {
8 s; i% l: @7 a, c0 ~        # Catch all incase there's a request method we're not dealing with properly
  ^/ H" z' \/ m5 I        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

# X. k1 v" S$ ?4 E/ R2 b    if ($cors = "trueoptions") {
" v7 ]9 |% j, z; H6 w        add_header 'Access-Control-Allow-Origin' "$http_origin";
: o) o, s% E' n; T% G  d' j& ~- o0 n
        #
        # Om nom nom cookies
3 [, Z8 F2 k2 \# R9 ]        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
1 Q; L* V6 L5 W) h9 _/ g" J
        #
. b' O* N7 Q1 l0 P        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

7 W# F, C3 s, W; J' \1 D' j4 ~        #
! Y7 o( t& j6 Q- K( R: d' m        # Tell client that this pre-flight info is valid for 20 days
' v  p1 \9 Y" S4 o        #
3 ~6 `" I3 N7 f# q        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
( O/ k! n6 {+ k! e  u* G9 R3 c3 I        add_header 'Content-Length' 0;
# A/ A+ U4 W" r- P* N4 ]5 K9 Y* b        return 204;
* h+ o/ C( E1 `1 b( L4 p1 @    }
) t6 d" @1 e1 s3 B) P* o
    if ($cors = "truepost") {
5 ~' k# m  W6 s- d' p+ j        add_header 'Access-Control-Allow-Origin' "$http_origin";
$ x' Q) N0 m% f) \$ ~        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
/ Q# B2 D) g; j0 K! _
7 L, ^$ p; N$ C$ P  v% y5 U  z  {2 X}

2 W2 g- \- j$ f
6 q- c( i7 V2 r2 Y0 u) k