Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
/ S/ E' Z$ c, z$ ^  g

# CORS header support
/ H% z% G  ]# B+ j#
+ `* h" g6 N! B# V# One way to use this is by placing it into a file called "cors_support"
0 @) Z$ k. X$ Q& Q5 K# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
5 L# B; N8 K- z7 W$ e/ M5 n5 Z#
#   include cors_support;
; _. H  d5 M! A$ @. T2 m1 d#
/ F) z) D$ Z2 j/ P- V# As of Nginx 1.7.5, add_header supports an "always" parameter which
8 n" L+ q$ a8 X, W# J3 S  E# allows CORS to work if the backend returns 4xx or 5xx status code.
#
; F  q$ u, o/ Y  a% S; y  g# For more information on CORS, please see: http://enable-cors.org/
& G. N% q: j0 J1 U- v# Forked from this Gist: https://gist.github.com/michiel/1064640
#
. `. v# g# f, b3 G2 e5 B
! S0 [1 @( p6 F) R" Lset $cors '';
) v, g# H4 Z* E- uif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
3 D7 @+ Z$ u; n* j& k( q        set $cors 'true';
/ P* o& x& ^- h- L- [}
# J/ z7 `" n( m+ q! }
4 |8 @( {5 V. y7 f. zif ($cors = 'true') {
1 Z/ s8 ?) `2 n2 J) O        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
* d; S# a- E' A* k2 Q, b! \# x        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
9 K& K: a( R4 w* w        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
2 e9 A( U% t6 X        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
+ e7 C# |1 L& J  z}
; W2 I7 e9 Y( n& |+ q) s
if ($request_method = 'OPTIONS') {
7 a8 I7 f: q  s5 m        # Tell client that this pre-flight info is valid for 20 days
3 |5 }+ V- a- R/ e) t        add_header 'Access-Control-Max-Age' 1728000;
4 T+ P( Z# j2 r$ F' Y8 z        add_header 'Content-Type' 'text/plain charset=UTF-8';
5 h+ o* H, ^# _# C        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
3 r: o: l' ?9 p$ x2 q/ H8 I% s5 e     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
& I7 ^. U& {/ |( ~5 L# H" }     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
: B" p; V- j' N0 `# D  Q9 p. T     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
}
  O! T# o+ @$ x( B/ U- [% l; yif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
, w' `3 l1 ~9 _/ C0 ?0 D" P. p     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
! `7 @9 A& M% l6 }* y#
# Slightly tighter CORS config for nginx
+ a: E) D3 t# w% j#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
! a. X, ?6 s7 Q3 p: S& z# Despite the W3C guidance suggesting that a list of origins can be passed as part of
  S9 V# ^) ^: o" t& p1 ~8 H/ W# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
5 g8 B% m4 g# E$ `1 B0 `# NB: This relies on the use of the 'Origin' HTTP Header.

6 D. E, X3 U% y: b6 T9 L( Dlocation / {
( t4 b5 ]* H4 \
# s% H* ^2 O9 p# |& F( K    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
* _' I) g, P! B1 K! p; B        set $cors "true";
  i( e+ u1 U7 Y* v/ P8 N    }

% p2 p0 B! _2 |+ M. X/ K; P# G    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
. G5 T9 |5 k3 K  s/ y5 m/ X    # Determine the HTTP request method used
' u0 h/ H( [0 m    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
5 K+ z) O0 V* b/ X% {3 D    }
* |  h. o% M, k" K# p- S& Z    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
. Y* R/ i& m( h% q5 A4 E$ n" F8 J    if ($request_method = 'POST') {
        set $cors "${cors}post";
9 L; }8 E' R. h! \4 s    }

    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
2 k/ u& w  G% _* A& U, q  U        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
. n* s: Y* I6 O/ x0 c1 `7 C( c
    if ($cors = "trueget") {
4 V0 o8 f: _4 X; |: `' V        add_header 'Access-Control-Allow-Origin' "$http_origin";
, {5 t. w, ^) b3 ]1 N& s        add_header 'Access-Control-Allow-Credentials' 'true';
. T/ C/ \6 D# l! f' o8 B* k, T, R1 ]        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
3 J) A1 ~1 Y% M3 q6 r        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+ I1 m1 h6 |( Q    }

8 ?; E! V& _' N    if ($cors = "trueoptions") {
8 q& U7 t* f2 _2 S6 ]) C; A+ h        add_header 'Access-Control-Allow-Origin' "$http_origin";
' _* `) }+ y6 H* {  _4 p) ^' a( w# M
& t9 f& ?5 V" j        #
& a% R: j& P- M" N2 }+ e        # Om nom nom cookies
        #
: b/ L% ?$ m6 |# U        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
1 a1 I( f0 b3 i2 x# Q
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
2 `" p, _4 a$ P0 H! ?! q$ r        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

4 ~# t9 e$ E7 V* f- F1 \% h4 u        #
) F( |+ D4 [3 v2 u( F3 k        # Tell client that this pre-flight info is valid for 20 days
+ q- f0 S) p5 w- y( H( j- P        #
  I4 Z& I2 L+ F5 L1 Q4 h/ q        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
$ `9 }) W1 ^* b& z; z        add_header 'Content-Length' 0;
* X6 r+ K; |0 ^$ W        return 204;
1 o# `1 B+ t" t    }
) M, x. N- e. m, r! m
    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
5 V# l6 h& h  c5 J* m    }
- ~* L4 l8 x) L2 q# Q4 E
}

& n3 |8 u5 W! R- j5 X( K
4 u9 l3 {/ r9 r