Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

tid=101068&以下是gist.github.com支援reverse proxied APIs的範例:
' ]! R3 T$ d* a  q! V: `
, U" F0 _+ V: V# d

# CORS header support
5 _" I6 i6 B9 d, b+ r8 q. v#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
#   include cors_support;
7 B( `' ^* P0 K#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
' x5 W8 X. V; A  K3 z# For more information on CORS, please see: http://enable-cors.org/
" f' @% t$ [$ `" e' `% g: a; B# Forked from this Gist: https://gist.github.com/michiel/1064640
#

set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
. l- D/ K; S% G8 r9 I, E        set $cors 'true';
! }, V) y1 D5 ]" U9 J3 }- u}
$ r& U7 l7 O3 O* [) n; Y3 S
if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
" k8 e# O7 X/ d* E        add_header 'Access-Control-Allow-Credentials' 'true' always;
  H& P! C4 \- g, o" e, d        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
. a2 \# k2 v/ Z/ F0 N8 b        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
; M/ \( ^$ H5 n5 Y* m* M$ L
if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
1 [. L: K! J" ]" G1 V. Q2 z" L        add_header 'Access-Control-Max-Age' 1728000;
( h) e! |4 ~/ ?$ |3 X+ d8 _* w' E        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
8 P/ O" i" A0 I6 a$ B/ q        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
2 G: ^. r5 A- O; A  z: H4 x+ z/ ]

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
1 Q% O8 S( ]  Fif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
8 I4 G7 ~/ `$ K     set $origin 'https://default.yourdom.zone';
) T- d0 g6 v! U+ P}
if ($request_method = 'OPTIONS') {
; U  N1 x8 u7 u) Z1 k     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
2 z: I: {$ P) c3 ^     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
# M# `- @2 r: n& m% {) p; w$ u     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
8 A2 |9 N; B( I2 B; ^. O* p9 v     add_header Content-Length 0;
& @0 ]. i( @& L' S: e# g' _     return 204;
}
, e2 H# X) t" u7 c' I" S1 rif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
8 ?) G1 |4 S# \9 ^2 f/ m     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
$ i1 Y$ G+ X3 h, Z6 \: C     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
- W% t1 q4 Y0 `+ X#
# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
/ Z9 t2 X4 V9 M) r3 `#
4 r. H; T% I8 v' C2 a  T2 ?' ]1 c# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
$ d* E- Q% {/ W3 E' J% J# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
6 i- _, X$ U& u; ~# method to control access instead.
4 |1 L0 F/ o$ l! }1 l. f#
0 J7 x0 D4 Q1 X5 \* N# NB: This relies on the use of the 'Origin' HTTP Header.
; F. \9 M  S. m! u6 Q
' v2 Q, o$ {2 @# h5 W1 e6 llocation / {
+ o5 ]8 j4 u  Y/ m9 m
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
" `' X- }0 n% H* G: ?        set $cors "true";
# O, L' B3 _7 [" M9 f  {    }
! G2 M7 w% o  w/ s$ Y. U& z' J
) P- `. p* i4 `% P; d    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
6 L' }: K- B1 _/ ^    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
) }! r# u& ~* h6 F( J    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
- {; x: y" a; O7 K& S    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }
2 I" [6 w5 l4 r( E$ @$ \! @" T
    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
% ?$ O2 U6 O4 V3 x    }
% P$ d/ f$ o0 ~. p* G" M1 D; ?8 X
; l8 ]" U( V: p+ ?# _  x    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
, }7 V/ u! i/ o" ]        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
; H: f# S" `. `0 i% S/ p9 R; [+ x        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
! Z; K, Q' A' P& z' z8 \; g& U+ p    }
, f7 p9 {. Y3 b1 f' u; u1 j$ q
    if ($cors = "trueoptions") {
9 ?2 L: c. E# K3 z  o) Y9 Z. p7 R" Y" v        add_header 'Access-Control-Allow-Origin' "$http_origin";

4 \6 D) X$ c9 k, X; a3 `1 P2 W4 \( s        #
        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

* e3 I8 V, |* }% B; _        #
        # Custom headers and headers various browsers *should* be OK with but aren't
* \# A: z* w: D4 F        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

- B* S/ m* P* h4 I- Z0 m7 P4 e        #
        # Tell client that this pre-flight info is valid for 20 days
6 e6 c) Y5 E6 Q; x7 i        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
" v# J0 X" C) j3 \' C  s3 q* `( ~        add_header 'Content-Length' 0;
& c+ N2 s) \* n, C6 {  g4 T9 ?        return 204;
2 y9 @7 }" N$ p9 |- l& K5 c    }
* ?5 _! o. I8 ?+ _# z/ o7 W3 `& W
    if ($cors = "truepost") {
* ~) t$ a7 ]2 T0 F5 N; b        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
) k& M& C# @. L. o# X) s% [; ?# t% @        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
( v8 V$ ]3 X+ P# z) d! D        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
9 t+ [+ v1 ]9 K7 R5 w
: c% `* L3 Y+ h6 c0 N, A1 I8 g}

) @' U) E9 Q3 R. f) G  r