Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

tid=101068&以下是gist.github.com支援reverse proxied APIs的範例:
0 d- I5 K1 Q1 p+ E% U6 n% s

! H3 ~: ^) h$ n6 G( R0 b3 j( r2 p

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
8 n+ F0 ]0 H8 W$ t, q2 a# ~# statement inside your **location** block(s):
#
#   include cors_support;
# S$ ?! {3 C. D* s* p# {#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
0 a! H! T( o  c% f2 e# allows CORS to work if the backend returns 4xx or 5xx status code.
#
) e: S$ J: ], H' I# For more information on CORS, please see: http://enable-cors.org/
& K# m- e$ i  P; H# Forked from this Gist: https://gist.github.com/michiel/1064640
  I& k& V9 ]1 y/ p#
+ A0 H6 B- t. @! v" d
1 n; M) `* J) c4 Tset $cors '';
9 j, V7 k2 M9 p. i8 Mif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
4 s' G4 @4 i$ Q1 z& m6 B1 C2 q        set $cors 'true';
}

8 b! R7 N% ^  O5 J6 Aif ($cors = 'true') {
& p/ t# Z5 x! i6 S        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
7 r8 w) [- g3 o% B% ]7 a$ V) k        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
( E  l8 f1 E( M  B2 }
if ($request_method = 'OPTIONS') {
1 `9 B, [$ g+ Z* C: L        # Tell client that this pre-flight info is valid for 20 days
" J( B0 v  [; s4 E        add_header 'Access-Control-Max-Age' 1728000;
8 S* q  a! Y1 k7 q/ c* S- O        add_header 'Content-Type' 'text/plain charset=UTF-8';
) L5 U" _. x; m        add_header 'Content-Length' 0;
, H$ o2 H+ s, W* O! l        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
+ X5 K+ X4 |0 F! t- ?1 g4 t}
' Y5 ?' s( U, S5 [3 h9 pset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
' s" s+ }4 ^& _/ Cif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
) m$ ~6 C; @# k8 F1 d' J0 u) F2 O5 f4 z     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
0 s7 n" V% e, `}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
: M9 Y, I2 E6 I  E" X/ W  Z' v     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
* s: X. T2 }( T" v     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
" ]0 @2 l' n0 }     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
6 _$ ~2 K- b- x( |/ Z#
1 E! Y: Y9 k$ I. t6 H& r% s2 M0 L# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
+ K+ [5 K8 G) D0 n$ V+ b8 D% x# Despite the W3C guidance suggesting that a list of origins can be passed as part of
2 u4 ~/ [$ }1 P  _+ K% P# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
' B2 D' R: d9 ^8 s' U# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
- @$ O6 z0 W+ g# NB: This relies on the use of the 'Origin' HTTP Header.
5 p. ~& \  `. Z$ Z* w/ c9 C
- y: y* p2 S6 |/ Glocation / {
# k  R, g! M, N& ~
; J& m7 g* |, `; d7 o, k    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
& z, H/ G% q4 l+ M/ z    }
  o0 F9 l; q7 f: F) x
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
7 b( B! i& R0 v; {9 u    # Determine the HTTP request method used
. U& e+ M0 R, r* h4 C4 Z    if ($request_method = 'OPTIONS') {
$ t1 {3 t5 m7 V/ S+ e0 M        set $cors "${cors}options";
    }
; j* l% e$ D( u7 j    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
( A3 S7 z4 B; J8 G, T" b6 u! l    if ($request_method = 'POST') {
7 y) W7 ~3 |0 @6 V        set $cors "${cors}post";
- k) o' a. }" ~$ C  I. m    }

    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
9 V! z5 q; h# M9 S5 ~. p$ Q* v        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
) p, t& n* F; H4 M2 _! ?3 D4 v
    if ($cors = "trueget") {
3 b! P7 t2 G# p+ [+ ]1 Z3 p        add_header 'Access-Control-Allow-Origin' "$http_origin";
" @" O5 E% \# F( C0 [        add_header 'Access-Control-Allow-Credentials' 'true';
2 O: f9 I/ z: Z1 c& m/ r# V        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
  N+ O: v- _) g. @( g
/ y& p9 `  J* T. ^  n    if ($cors = "trueoptions") {
- ]9 `* }: ^) N1 c4 }% M9 i( D        add_header 'Access-Control-Allow-Origin' "$http_origin";

. W5 X1 O9 y9 F0 u/ t0 q        #
$ C) l( k& k+ N. d% {        # Om nom nom cookies
/ P8 \' m2 z% U# M# f        #
. l2 [; [3 S1 j' X        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
# q) F( y9 T0 o' d" Q. w
- U/ ^- d' R' n1 x        #
        # Custom headers and headers various browsers *should* be OK with but aren't
. ^1 q/ E: S! r# L) b- b6 x' o9 @        #
* J9 |& d6 M0 ?5 Z        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
2 h/ R: p" S" U
        #
7 J$ c' T1 ?3 K+ H. E        # Tell client that this pre-flight info is valid for 20 days
        #
$ K5 F& [. K! V1 g7 t        add_header 'Access-Control-Max-Age' 1728000;
1 P  k, b6 {, p9 ~1 \, k: b( d        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
0 F! c9 S( C& `8 ~* l* R% j    }
3 e8 i# Q1 ?5 E* I
    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
  ]- p& u8 B( P  m- R6 u; q        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
5 V" o1 D$ e( v0 _        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
0 M; F' t2 r4 J& f" t    }

8 \# x4 k9 ?" Y5 s% q; D6 e}