Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

tid=101068&以下是gist.github.com支援reverse proxied APIs的範例:
% x/ A. y- P1 N" L

* c) J4 Y6 c+ i; h. m" }- M' o

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
# J# a5 |# m3 J9 Y, U" J#
#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
5 D% Z1 M8 M! a3 }" A, A# Forked from this Gist: https://gist.github.com/michiel/1064640
#

set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
$ W8 m( |0 X% U; v        set $cors 'true';
9 N  [: O: E  h}
3 T6 u) V! M) g- Z6 n
- r, i; d, ^% ^# [0 K" Eif ($cors = 'true') {
, [7 r6 W: ~" D) @2 V        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
& G4 o! H& R8 q: e& G% m  T        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
8 ~- u# f$ h2 x  l2 M7 S        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
2 G; Z6 s3 n6 D0 s3 o/ ^}
7 I! r) k) Z( ?
if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
' |1 f' {2 t5 b9 }! _        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
  m0 a7 \! w- U6 M( K( B) H        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
5 R' p4 m$ q/ j; ~7 d" Y; R# X

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
. u; o$ y( }2 T0 m1 o  }5 k3 zset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
' _& H7 q) h+ ?0 X# M     set $origin 'https://default.yourdom.zone';
}
' W$ K8 O: I6 Sif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
  T& U% l( i0 W! q' b8 S  q     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
  c( O0 Q! w; f0 ^& ^/ U2 \7 o; }, E     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
3 }# v1 j$ H8 Z: i( ]6 g     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
* e+ Z% D* g; |6 d3 h& H     return 204;
% \* }0 F  T( {" c8 J1 [' s& g8 g}
2 i" ~( Z* k# L2 r# hif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
, F/ R$ x# u; ]  D# D6 k9 I     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
" |$ s  B' h6 T( d% \, t$ {, K" q     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
; r6 t5 k" `0 B2 c# u' x}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
9 _  \/ ?/ h6 W- K0 C% ]8 _8 q/ c#
$ q; r( d: a4 l$ \/ o# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
6 u- p% B' J& _7 @# Despite the W3C guidance suggesting that a list of origins can be passed as part of
2 M; ?. ]) w! J0 N  u6 D1 u# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
+ F" q2 F) ?8 ~8 q8 v. y# don't seem to play nicely with this.
) I+ M1 e( Q2 M# E5 L* z#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
; l6 _8 s4 ~* j( `4 r5 N; h# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.
0 d" d" E# E9 s7 C" f2 Y. T# c
location / {

) q7 _$ g5 y% V3 @* j4 n& {% U- ^3 o/ w    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
4 X( n1 h9 h% _4 ]& u1 U        set $cors "true";
    }
+ ]* X8 u# f0 ]4 C7 H/ ^
4 A4 J5 l2 p3 o3 S" I  r    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
. y& m8 U9 r% g* w8 D. F' p    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
, ?1 a6 A8 `% j    if ($request_method = 'GET') {
        set $cors "${cors}get";
6 V. Q+ C$ v/ _# G. G; G2 D    }
' h; h8 h0 k. D  ^+ B    if ($request_method = 'POST') {
8 R5 X1 E/ n8 i6 [/ d        set $cors "${cors}post";
    }

    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
0 K5 o: `5 E; l6 ~* q. C        add_header 'Access-Control-Allow-Origin' "$http_origin";
8 {9 l. B( A7 m    }
! @5 O/ E  f  n# s% o9 p% s
    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
9 E# ^( M4 ?  h4 z1 o        add_header 'Access-Control-Allow-Credentials' 'true';
, h" L1 }  v( o& k: G; Q        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
; d% O2 T9 F! [- G& A$ |        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

2 O/ d' r. V; ?+ x! D% l  g3 t    if ($cors = "trueoptions") {
: L+ p7 J1 a' w; M        add_header 'Access-Control-Allow-Origin' "$http_origin";
% x0 k5 i" i: q& o. u9 e7 y* @
* v( q  T5 W1 b7 J" j. q        #
        # Om nom nom cookies
        #
! z4 a$ o/ F) d5 _* ]8 `        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
5 _6 F+ e8 [9 q; O: Y$ {
        #
7 @. C$ T* [- m7 y% s5 i        # Tell client that this pre-flight info is valid for 20 days
4 L0 @) m7 \$ a8 m        #
5 _0 g" ?' T4 {( F        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
: a$ W6 {4 ?" o! S; ^/ Q" r        add_header 'Content-Length' 0;
        return 204;
    }

; U' i8 [/ b* r) O* c* q( L    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
! {% C; P5 n* t9 J        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
9 a5 O: F; `' }. G+ A4 O7 ?1 G        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
7 ^* L3 c" u8 N0 E
/ u9 c; E5 {# [/ q% a}

% y+ W) q6 b% d( p% O& K' K
; Z- A, d. h; U. c5 r! J