Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

tid=101068&以下是gist.github.com支援reverse proxied APIs的範例:
% ?0 W) T1 }8 x* |, u8 q

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
* I2 i2 H8 d6 w+ n# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
+ E9 b' o; A  j5 @$ M4 k  m9 w#
#   include cors_support;
#
$ j: N9 u3 U+ Y5 r# As of Nginx 1.7.5, add_header supports an "always" parameter which
) Q; t: k3 a7 r# allows CORS to work if the backend returns 4xx or 5xx status code.
#
5 v" L- V" l# p$ Z2 l# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
$ B) F6 ^; |# ~  Y" u. S$ ~; h#
. o! Y4 m! q4 G) @6 m) h8 ~
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
0 j: y& u! L; ^        set $cors 'true';
}
+ d, a! H, f" ^) s% B7 S
. c0 K" H$ g8 vif ($cors = 'true') {
3 k) [- j1 I# o1 x. A" }        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
" m  v/ u' e: G, E1 v5 [1 K, ^        add_header 'Access-Control-Allow-Credentials' 'true' always;
0 Q0 i/ z# e2 v        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
: t& Z0 w$ _/ y7 R3 V        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
& A* n+ A- f2 s% c8 y        # required to be able to read Authorization header in frontend
0 j6 b" l7 _+ M6 A        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

if ($request_method = 'OPTIONS') {
1 p5 H5 j' G( G" a        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
) D8 ]. i5 g0 W1 T        add_header 'Content-Type' 'text/plain charset=UTF-8';
5 h! x; f% ^  f  y5 z- M        add_header 'Content-Length' 0;
  v$ g& I! B+ ~: x* c        return 204;
8 U. B7 _. |+ l}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
/ z+ H$ ]8 Q7 R: e% q# g. a

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
8 n, `9 O7 P8 x5 @) ~) s$ }     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
: ]1 i4 z4 a  I# Z6 j3 r1 ]     add_header Content-Length 0;
1 x$ M0 b9 f* ?- N* w% `     return 204;
: Z6 Q: H/ \) x, A}
* h9 H1 J! ?/ v5 g' ~$ A# Zif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
( n# F+ U2 Q2 c# D3 Q4 D     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
5 x2 Y6 D# b" X; S  I     add_header Access-Control-Allow-Credentials true always;
* y4 D* ^( W! c. n}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
% t0 ]/ F9 h# t! q$ V  q$ \1 V#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
& J8 _% K5 C$ t& V6 x# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
/ C6 ^  Q- x9 w, K- \- F: Y% h# don't seem to play nicely with this.
#
0 b$ G, ?' B) Y4 C, Z1 J9 n9 [# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
+ w# I% I, X3 ?; ~. y# v: `# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.

4 d$ u4 B5 w. u) ], o( q) G  glocation / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
, q6 z6 g3 Z$ E4 z. K
" i* O) i. Y3 ]! L, `  n4 Q; {. a    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
: w5 E! ]+ P7 ^! S1 p9 e    if ($request_method = 'OPTIONS') {
+ i- N. v9 f. E! R- N( ~: }        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
, D7 _# p% ?# K7 s        set $cors "${cors}get";
    }
& D( v, k7 S0 {' O- Y1 U    if ($request_method = 'POST') {
/ I) e. L, U' K' o1 {; G% N+ c, c3 p$ X        set $cors "${cors}post";
5 j: v9 G6 @2 p: C/ B& U    }

    if ($cors = "true") {
+ a% D1 ]9 N8 i. F2 C( G. h        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
: V7 z9 v, L& N1 r    }
' g5 M& [, E5 Q1 g3 h" o0 V
; L' k- n3 b/ x' ^    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
" [( F/ ^) w/ m+ i        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
$ a% ?4 o4 q; n% [1 d, l, a( v    }
1 k+ w7 h  G3 R. h% Q; F
    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
/ x: |- e$ @- C5 r+ r+ I
        #
; i' L+ ~' N7 k( Z        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

& u2 N  `# `  S9 p0 M1 n/ R2 x. |        #
        # Custom headers and headers various browsers *should* be OK with but aren't
* F2 ^- e) B) {4 Q, @4 c        #
2 l- }  B* x* f) R/ x( \        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
! |1 g  G9 z7 z+ c3 m6 N  X
        #
( }- |% Y) `; n# M: Q& O+ ?        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
. s3 t3 t8 `' y/ `        add_header 'Content-Type' 'text/plain charset=UTF-8';
" F% p6 _3 J  @' m1 H2 J        add_header 'Content-Length' 0;
        return 204;
( b& n  N+ C4 ^# c% q. X+ [. R    }
& z5 E* s$ C2 }" o8 X8 d4 T
5 o6 f3 |: X* }+ _1 z    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
# ?/ C7 K- m0 C  @. A  Z2 F        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

}