Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

tid=101068&以下是gist.github.com支援reverse proxied APIs的範例:
5 f- }2 r% U# ^2 E9 G$ x. r

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
, x7 g0 g( g( o0 t; K# statement inside your **location** block(s):
#
( g4 d: y3 H! \7 Y#   include cors_support;
#
9 U  d6 ~5 `) e! Y# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
3 |0 Z$ p. F9 n3 N, m7 S& r#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
. T# ~8 N; B! H9 z
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
8 ~; k4 L8 A' M8 U- ]8 F' s/ D        set $cors 'true';
}
, ^3 l% h1 A* O9 E* f, _0 H
if ($cors = 'true') {
/ a: Z1 S- q8 E: n        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
. P: r. [& x& z; Z& H% B8 a9 Y. g        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
# B9 {/ i* K+ T2 t: E% V1 {        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
! r& a' Q- X2 E8 k: p' K        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

if ($request_method = 'OPTIONS') {
# u1 E& Q6 X+ B" {        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
# o" k- [) p; _& W( ~) R6 l9 y7 X        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
& @& [0 l9 x0 @1 n! {8 P        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
& t$ K% M$ U/ f9 Bset $origin $http_origin;
  _: }$ g% t; p6 u* _if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
- w) ?2 F) d' R8 `$ A+ q     set $origin 'https://default.yourdom.zone';
}
1 g8 Q  f: g! w! E3 M( B  ]if ($request_method = 'OPTIONS') {
  m: S& s4 g3 h  a& r& {! W     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
/ h1 e4 p  N1 F- R& Z0 g     add_header 'Access-Control-Allow-Credentials' 'true' always;
- \7 ]$ ^" t3 h1 \7 v     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
0 W# B& V  j  j5 @/ P4 o     add_header Content-Length 0;
     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
6 d+ Y- F& l# A, U& f* `7 G     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
' n0 p$ f7 D* x# K$ o: `0 A; v     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
! B2 L7 `' t7 s1 C#
/ J$ \( K% s" Q4 L7 F5 `# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
' I5 ~% s9 v! N! \# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
# H4 G4 G! b1 K% p2 Y" r# NB: This relies on the use of the 'Origin' HTTP Header.

( t- D4 L: l, G# [$ f: zlocation / {

+ M: D3 S$ E7 U/ y, e! U: q$ e2 V    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
  z/ S* w) A0 L1 v" o    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
+ g. B* O/ ]$ P( L5 x0 ?; H    if ($request_method = 'OPTIONS') {
, K+ ~7 p( T* e        set $cors "${cors}options";
    }
$ H! ?9 {+ t  p: s0 D* ]/ C- q3 p$ o8 [    if ($request_method = 'GET') {
; a1 U  P) s" D* P8 ?        set $cors "${cors}get";
    }
0 h% y1 Y8 d# Q+ B    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }

    if ($cors = "true") {
( r; P' g- \$ I& R. k) W        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
8 O9 Y' e4 I2 I% u    }

9 b4 _+ K* t2 a) u$ P0 _0 T    if ($cors = "trueget") {
3 x' L+ Y3 _2 q* V! b) M, V/ R        add_header 'Access-Control-Allow-Origin' "$http_origin";
, S5 h1 M- B8 P+ R        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
1 B7 B7 ]& a+ v        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
; M) h* N1 W3 ^" `    }

  k! G: m1 v5 t    if ($cors = "trueoptions") {
; M$ P* R  i( Y. j' l  ^1 \        add_header 'Access-Control-Allow-Origin' "$http_origin";
, K6 z; O( X+ a: X% z: T! I& N
( o; F2 D; w8 Y* N5 O* W7 _        #
+ A) X0 S& C& b2 a' ]' u        # Om nom nom cookies
4 l+ E2 z! `7 r# E        #
        add_header 'Access-Control-Allow-Credentials' 'true';
# B* y0 W$ ^5 E" D1 D/ Q        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

( L9 r1 p& {3 v" M0 E6 O" F2 J8 Y        #
! N0 S: H+ Y9 B+ x+ n  b        # Custom headers and headers various browsers *should* be OK with but aren't
        #
$ R$ r4 X& L, x        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

3 P- I# ^# ?3 J& O        #
! \! E% M+ ]7 r8 g5 Y2 t        # Tell client that this pre-flight info is valid for 20 days
) y! u5 `. ?( Z, b. D# k$ F% O) z        #
7 x% K) `4 }% G5 G1 N) q        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
3 w& ^2 C; r' C        return 204;
# W$ C/ u& B# G3 o5 ^    }

    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
9 Q7 }( I: r) J; |& o* Q( ^0 p( I        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

}

% g6 {  s# ~2 {: l  o- x
9 n0 W( L8 i2 t