Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

tid=101068&以下是gist.github.com支援reverse proxied APIs的範例:

1 Z  a! x# a, I1 \" q2 g5 n

# CORS header support
$ H2 D9 H$ X. E1 w* z) E% f#
/ p5 w( v% }6 s$ Y* ~# One way to use this is by placing it into a file called "cors_support"
( X2 d) c  n; _* ?0 O9 c# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
1 p" D" y$ ?  c# v#
9 P! Y% e0 ~7 ~; g#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
0 D8 h& Y) T" Y# allows CORS to work if the backend returns 4xx or 5xx status code.
. Q0 N+ }" q% N- c7 ?/ `0 F#
# For more information on CORS, please see: http://enable-cors.org/
: N. i; O) E: b% y/ b9 }* A# Forked from this Gist: https://gist.github.com/michiel/1064640
0 N9 ~# W1 @! f. n4 U1 q& m) I3 a+ ^#
/ b3 J- r" A1 a4 x; K' J6 a
0 r- d% h, f, ?% L; X% jset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
" I* f/ |- q6 E" L" f}
0 v, w9 v& _) l* u
if ($cors = 'true') {
0 B7 [# f+ F* i        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
5 C2 s( T$ J  ]7 p* Q. u        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
' W3 \, l" o, q7 I- t        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
0 Y& m6 N! y5 m7 ]        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
+ k8 N0 d* C; ^% h& O$ f" f}

6 w# z9 ~+ X& P6 Jif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
# U+ J# Y& ?7 p$ Z' h3 C0 u' m* n        add_header 'Content-Type' 'text/plain charset=UTF-8';
/ ?2 B$ z5 M: W" E' K2 n        add_header 'Content-Length' 0;
        return 204;
. g7 w* `$ ?( M/ Z: I" B) Q}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
* n2 W: R$ f5 n/ A4 l8 C/ `7 c

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
8 B6 v. @& l8 e# s" `2 Z}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
7 N& c+ F+ ]/ ?; Sif ($request_method = 'OPTIONS') {
. p( @6 _7 H9 T7 t: [) q. t     add_header 'Access-Control-Allow-Origin' "$origin" always;
9 {) l! S2 ]' V1 p3 L     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
" h7 X5 b$ B1 [7 D0 n% G8 ?8 z     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
}
2 r9 Z  b9 l" @! Uif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
& y( |! S% l# P/ w- R! e     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
8 y$ Q1 q, j: L- H2 x2 a6 h4 f     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
, K* S% P; v# r% n}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
3 I5 X& u, k  ]+ Z: p9 _/ u' L# Slightly tighter CORS config for nginx
#
: U4 o0 R9 C/ D# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
! Y# k7 F) F8 |0 r+ }/ C, }" {#
; b) s" j5 l! u$ P- ]7 }3 D# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
4 N. a. F$ O7 \. `8 |; ?8 J# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
% T( e1 _6 c$ N; I# method to control access instead.
#
1 h" F* D. D% h" o3 V# NB: This relies on the use of the 'Origin' HTTP Header.

2 Z4 ^, b* i; ~  h3 n  [' Zlocation / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
# A. `( n. P  m. d) U2 m
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
/ @2 |+ ?6 Z* X' i* c    if ($request_method = 'OPTIONS') {
% K) L) A0 ^: P0 K$ S) S- s        set $cors "${cors}options";
    }
/ L, d. n% D' h* |7 D! r: Q    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
" W7 a4 s$ t$ F2 B2 x, p    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }
# |  T4 Q) X0 Q# ^
    if ($cors = "true") {
+ z( I; K. f% r2 |  |  l$ d        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
, G- s% ^- v+ {/ W. ^7 ?3 A: X6 u    }

' S9 a$ _/ W5 }8 }    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
* U, g2 i* p3 k3 N0 U* Y; F5 y) P# w        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
/ H  f1 G5 @# u0 i% x" j& z9 a! U    }

    if ($cors = "trueoptions") {
5 i$ k% M: x, X/ E! ]) g4 Z        add_header 'Access-Control-Allow-Origin' "$http_origin";
$ m, u) a; b' G: w3 w0 ?  ^
- x/ j/ L. y, [) G0 }% i        #
/ O6 |0 Z- x/ p! d0 b, T        # Om nom nom cookies
: ]& j- q, {3 U, [- n' S        #
        add_header 'Access-Control-Allow-Credentials' 'true';
( ]' O( s3 @2 L2 i8 _: v# Y        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
1 K7 O( V) W) p        # Custom headers and headers various browsers *should* be OK with but aren't
0 \2 z4 r/ Z4 ]) T        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
% I; K" U6 Y3 m, N/ T. i% F
4 @' G$ c% o9 A! q" y! R5 u/ D        #
1 p+ b9 s  q; L: I/ l        # Tell client that this pre-flight info is valid for 20 days
1 y; X; q7 Q4 @- M4 s        #
- @; C3 L8 i$ U+ f        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
. ^$ @# \# i/ N1 S% [, R! W        add_header 'Content-Length' 0;
. L, Q7 Z# H& I% Z        return 204;
    }

    if ($cors = "truepost") {
4 J" z) a, M6 j3 J2 D" U3 e; y6 R        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
6 V9 X4 G% q: I: ], ~8 U        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
) i3 C0 ?! {% }! y- V; X        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
9 O7 c" e2 T0 x3 z8 i$ F+ M    }

}

& x& D! z4 y  `) ?1 }