Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

tid=101068&以下是gist.github.com支援reverse proxied APIs的範例:
: k. T* h7 v( O1 r7 r: f
3 A: {3 D0 |0 T; E: ?

# CORS header support
  c: v3 g/ j9 {/ B#
# One way to use this is by placing it into a file called "cors_support"
& h0 q% M; Q' k- J9 z# under your Nginx configuration directory and placing the following
4 d0 b: J* n+ ~8 y# statement inside your **location** block(s):
#
#   include cors_support;
; H& ?: @+ w/ b1 X( A9 H#
* ?+ J# D3 i% ^! S. z# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#

set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
) ^1 |9 x: Z5 ^3 m/ H3 ~6 r        set $cors 'true';
}
" y1 V2 @' C) U" q" ?' e# ^6 X
4 m. W+ j: `; ?( S* }if ($cors = 'true') {
+ b5 N1 ~% i6 q* i6 L  d- N        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
3 k" W* r/ q' I: O. P; ^        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
1 M) u* r, e2 \& Y
" I7 L* S2 y4 h% h; Gif ($request_method = 'OPTIONS') {
9 ]% p% v' v, \+ A; n        # Tell client that this pre-flight info is valid for 20 days
/ q" s) i/ J4 \        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
5 r3 i" `/ L; O}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
3 P6 A; J1 \( g1 d

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
7 R/ f+ h7 Z" }% Z  o1 \  Iif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
' Y: m& d% Q: V: y& j1 T7 T) Z     set $origin 'https://default.yourdom.zone';
) p3 `( @: V2 {}
" Q0 u+ u8 x# Sif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
' E$ C7 d  Z2 C0 R8 u     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
+ K' I3 @! d4 J) V1 n4 ?     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
8 X8 t# E7 |8 G+ h% n6 d     add_header Content-Length 0;
     return 204;
}
1 e( u( k) k4 D4 o$ r3 Zif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
3 L$ L4 K% i( g) w/ f     add_header Access-Control-Allow-Origin "$origin" always;
+ ~1 k, G0 H: v# q1 x, I# v6 O     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
8 c( U3 x3 b+ Z* ^     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
: C/ G: o/ \* S2 v     add_header Access-Control-Allow-Credentials true always;
* m2 K' V  s, B9 r  C2 H}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
2 x" L3 k7 g+ n/ g; Z#
8 B1 E! B# y2 Z( Q# Despite the W3C guidance suggesting that a list of origins can be passed as part of
! p) ?4 T* {* r# e8 [# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
6 |& K7 S- w1 O0 P, t9 g$ q# don't seem to play nicely with this.
8 c4 r  U$ B* d9 K" i# B/ [" {+ }4 k#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
' I: c$ b; N, w& y! H# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.
4 |6 ?) J& ?, `0 w& V- e6 ~' @2 ~( I! [
  Y% S# O0 X2 |, T' J6 B. elocation / {
/ x0 f! d6 j6 f* q# z* y6 {
$ e& V% k/ C. c3 l9 }8 @    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
: L3 K# I! B. f5 {+ K    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
/ E. i6 O! S; a9 Z! N; P6 R    }
    if ($request_method = 'GET') {
; a7 }! V6 h( B5 C, t. x        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
1 g, x5 u2 V4 w! p. C3 h- w/ y        set $cors "${cors}post";
) l3 s' c# q8 m* o7 V5 b5 N    }
- A6 ?) N# ?6 S' B! M2 S
    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
& h6 X/ [6 ~+ q$ `9 E# t, D        add_header 'Access-Control-Allow-Credentials' 'true';
' m! F" h" \5 ~2 s1 c6 H7 n        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
# j9 ^4 l7 X! M3 L% m    }
  @1 }: f; l' ]2 y; k7 w$ G
4 A5 J' z' c& ]" [& }5 Z  ^, H6 j    if ($cors = "trueoptions") {
) z5 ]: m1 Z8 l; m' y! ?        add_header 'Access-Control-Allow-Origin' "$http_origin";
: u. v' @. \4 v9 a
        #
        # Om nom nom cookies
        #
' Q- A8 T3 F( \6 @: t6 e1 X" ~3 v        add_header 'Access-Control-Allow-Credentials' 'true';
- k$ u+ L8 _, h8 c% t1 t        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
9 M2 W9 y4 o! b" @9 n( Y
# z0 d7 ?' d! {3 B8 X4 `        #
        # Custom headers and headers various browsers *should* be OK with but aren't
- X: _! c5 ?* _# M        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
7 \5 r% F  e! H0 ]1 ~
        #
        # Tell client that this pre-flight info is valid for 20 days
( z$ c: i) Z* M# ]5 G! ?7 c        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
. F9 j3 n8 S& s! D' f3 p/ k        add_header 'Content-Length' 0;
, h2 ^1 p7 O! I- ?( g, x* W- f        return 204;
% i' C% ^+ D5 p6 V9 d& }0 f    }
. y" n' `. s  M' ^! X
7 f: A% p( Q1 x    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
! m4 o" j- ^. [7 Y        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
; n$ P; m! h0 F1 n* i8 G/ i        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

}

+ s( `- q2 T5 [9 \  E& w. g- Z
2 p3 C) [" d6 D5 }