Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

tid=101068&以下是gist.github.com支援reverse proxied APIs的範例:

, s6 @% O; x( ]. X9 S! {
4 |' v$ g  r; i& B+ ^4 M* ]

# CORS header support
6 L0 R1 A- m1 J# G#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
/ `& K3 u2 d3 P. t8 I) Y#   include cors_support;
# t  d' D! s: A# K( x! Z$ r#
9 C: D# \4 v6 K/ j8 }% V/ A# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
" D" n( L  ]) e$ G9 y- t; k# For more information on CORS, please see: http://enable-cors.org/
! |7 ~+ }# k% u# Forked from this Gist: https://gist.github.com/michiel/1064640
#
, m+ w+ A$ ?4 o7 v
set $cors '';
/ E7 Z* Q  G& K( B) B; l5 sif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
: i, ~  @. T3 s4 \. _0 U) F) O5 ?: e}

if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
' l; `% P/ X( O- y- F        add_header 'Access-Control-Allow-Credentials' 'true' always;
+ _5 x! s/ r/ |6 s0 V        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
" Q/ ^  o0 O# E! \  b; R) l
if ($request_method = 'OPTIONS') {
3 Y4 y' g- c. A$ x        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
: C' H  _& t' L9 r3 ?        add_header 'Content-Type' 'text/plain charset=UTF-8';
' S1 [/ j' E6 T+ n+ {/ `        add_header 'Content-Length' 0;
        return 204;
, [( D( v" T6 }$ O1 u}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
% K4 k2 |- W* T% b

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
& }5 [: S/ ~6 F5 m5 f( v% q}
) N! E- p: H9 o- Uset $origin $http_origin;
5 ?5 g9 D  e; {# [, f; P" b' u5 Xif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
* J' E& \" \* W4 Dif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
+ O* a" w4 P# r3 V+ _. o' F$ i) t     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
7 d7 x7 U) A' S: V. c     add_header 'Access-Control-Allow-Credentials' 'true' always;
, y' I8 _: |1 {$ t  W     add_header Access-Control-Max-Age 1728000;   #20 days   
! w6 B. T7 G+ b0 ^* A( r     add_header Content-Type 'text/plain charset=UTF-8';
: G4 v! P* Z5 D; @9 q/ u& c     add_header Content-Length 0;
) m8 Q& K- a, _% J* F: J     return 204;
; I: ?6 S: F! c3 }; S" I}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
; v) B1 ?8 ]9 w( I3 N     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
5 q- U, r4 b4 ~% A}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
9 D, M( u# b1 Y: D; Y7 z2 m# Slightly tighter CORS config for nginx
$ W  ?6 ~- u; v% |* D8 z3 V. r#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
; S8 Z1 h. F+ v& P1 _/ \: J#
7 ]5 \# F, C1 l7 a# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
, G) p% Z3 `: J# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.
& K& U/ S/ s# i: O0 F; x$ r$ w$ ?
location / {

1 n+ Q. _8 Z5 q    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
0 b" ~2 N( l1 g. Y& h1 J- X3 V        set $cors "true";
/ D, @  ^# R* x3 L& \7 a- Y    }
8 M2 O9 Q3 H2 o1 k8 G. b5 b8 s
( b6 [6 ^/ s+ k* e5 O    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
2 A( J3 E  t3 a+ k/ R/ l    # Determine the HTTP request method used
- K/ J2 V8 ~3 p- w    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
! Y  m* f' w- O6 s$ ]4 p& S    if ($request_method = 'GET') {
9 e1 e5 P' ?6 t0 }9 f: @0 ~        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
3 r- F+ n' \2 j" `% a$ V        set $cors "${cors}post";
    }
8 |0 O% H3 |" v& ]; A( P
1 r& L) ^5 {% X/ u    if ($cors = "true") {
9 b. _8 F1 `# E, l8 n        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
& ?8 q! Q9 d  x! ~. t; o+ F
" x; u: y' u- s1 G* o6 |; m! V) b    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
5 ~% x# O% F1 ]        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
( }$ I! u( \$ H! J0 I5 j( R        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
  ?& }1 ?% p- \! W0 @+ X( R    }

    if ($cors = "trueoptions") {
4 H6 P) k0 c. y( q- y  c        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
# A8 u. X1 x  T        # Om nom nom cookies
3 I  }$ Q: {, \. L4 G* Z        #
  N+ x8 B6 D- s5 N  i0 N+ ^        add_header 'Access-Control-Allow-Credentials' 'true';
- w, ~# {# @9 R! `! ^( Y7 \+ O9 k        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
' P- r' O" j4 z$ C$ _
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

& ]9 F6 x0 S6 X  t' k# F  G# V        #
* {+ b) r. V; n  Y) O9 N" K, L        # Tell client that this pre-flight info is valid for 20 days
/ _6 R: R& i/ c' ~' g6 a- q        #
        add_header 'Access-Control-Max-Age' 1728000;
+ s5 y- L1 g( J  U  p: ^4 ^% T8 x        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
9 O" {" e! r7 T; l    }
, Q' O6 `5 E7 d- Q" ?
. G) }! n' l0 n9 F- s1 b, Z    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
8 A/ q2 T% H- Q  G        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
9 i: z* o1 x3 P
}

8 l  D7 k; v0 s8 I0 ^5 B
- j7 M0 I, m% ?+ B$ j3 |' [