Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

tid=101068&以下是gist.github.com支援reverse proxied APIs的範例:
8 n$ S2 L+ s$ q% h0 j  p& Y

9 o8 p9 S* u1 V, l" ?6 ?

# CORS header support
8 }8 Y, D9 W+ @6 x4 n#
9 A; w- P+ T8 Y! T# One way to use this is by placing it into a file called "cors_support"
: U0 i/ @7 c2 ~( i# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
9 E; B1 ~; d7 v/ V9 k0 w4 U#   include cors_support;
/ J* k  r5 M2 x% y( r( J#
9 \- }3 E1 e3 G) _1 A, T) m# As of Nginx 1.7.5, add_header supports an "always" parameter which
6 L7 \2 u4 \; x; x/ _' M# allows CORS to work if the backend returns 4xx or 5xx status code.
& F/ N7 ~- G& Y4 k#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
- s1 b5 D3 w5 m5 d* F5 e* u#
  Y8 |& U2 q4 H, B, P
set $cors '';
' A$ c2 H. ^9 B/ n7 z, q- T8 ^if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
  `; A) H6 B! o3 E8 t        set $cors 'true';
! M; q$ {$ ^& T/ l& `9 H}
  X2 f: [# i! J* y5 h$ h
if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
. y7 E7 @% n( n: }        add_header 'Access-Control-Allow-Credentials' 'true' always;
/ P9 a2 w0 y+ N; H) R' ~        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
1 |/ L1 i* T. z8 F        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
  {" K8 t# B. M}
0 V' }0 @/ Y* Z0 d: e
' P3 b- s& R4 tif ($request_method = 'OPTIONS') {
$ Z1 v" O8 X, X        # Tell client that this pre-flight info is valid for 20 days
: j& Y+ N: K# A% o        add_header 'Access-Control-Max-Age' 1728000;
. Q. v5 O2 z' K9 ^" n( [        add_header 'Content-Type' 'text/plain charset=UTF-8';
5 m( C! c4 ^2 r9 X% n$ `, y6 ]$ ?' D        add_header 'Content-Length' 0;
+ D: |, E) d+ p7 R9 u        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
  y* @' H! Q# E2 p+ L

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
' {9 c  |& f0 F+ Eset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
+ S7 d, L& r1 B2 ]! z     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
2 s5 [5 T% B/ C% `0 Q     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
: ~- Q9 p7 m! [; e     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
- y, P  N. d0 z$ B& t; @     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
& n- F0 ^# u$ Z4 D1 z     add_header Content-Length 0;
1 T/ e+ O* P5 X$ l9 y6 \     return 204;
}
! T! v  B* f3 N9 S. Z% x4 P* P  oif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
& v& u9 S" E/ }$ |6 V- H; X     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
! x* e! |, A5 o. v/ O1 h     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
5 z% P4 F( P  {. v  N/ z9 Q}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
5 ?) ^2 g; }2 N  k! S1 X; `#
/ [' g9 l. q8 z) Z0 U) |# Slightly tighter CORS config for nginx
#
; c6 [" m7 D9 P' i4 {# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
0 u& M! a4 _4 [1 p# Despite the W3C guidance suggesting that a list of origins can be passed as part of
3 F8 t  C7 g3 p8 V- P! f2 }; K# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
% P  Q4 T' X& E# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
1 o0 S* {# X+ j" A6 G3 A# method to control access instead.
, N0 J  H2 a% h2 D; I( q7 \#
# NB: This relies on the use of the 'Origin' HTTP Header.
) q( m( A. ^) V6 S& e2 i- X
location / {

" l5 {/ B2 U6 E( @/ Z    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
) j' P% C% p) f$ [& l9 F
4 S( ]' J3 x0 n& y/ s    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
! Q5 Z% |$ U/ O( a" `" ?    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
5 h3 n  w1 l; J( Z        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
+ p! _1 x1 W$ K& m* @9 |1 X! m  u        set $cors "${cors}get";
+ D, g. n/ y& o. K3 L    }
0 G) y( k3 w& t. L9 }4 K. T    if ($request_method = 'POST') {
        set $cors "${cors}post";
! k! T$ o# s2 a  H3 E8 R    }
) F& y- ?% e$ L; x5 K" K! u5 s* T
    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
! \3 T! Y& x# l- v; t) m    }
8 D+ {/ m: x/ C
    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
# V4 @2 l! l! A8 m" r% }; R        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
# Z6 n) y0 |* r2 i6 Y    }

    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
% n+ b2 z& n4 u% ^
) h2 J: a* M4 V6 {, e- C5 R        #
$ N5 o8 K, D2 u$ ?5 v4 s        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
& ]/ o  l2 A" p; @% U7 @/ A5 h( v        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
" s$ O* k$ f" p3 q6 a6 |        # Custom headers and headers various browsers *should* be OK with but aren't
3 f( \& m' J  A! a        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

& g9 I% f* ^$ D! z4 O" R        #
        # Tell client that this pre-flight info is valid for 20 days
4 ^, b# ~' p/ B7 P/ R  o        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
- @+ M' \) D! O" k6 n; ]0 ~    }

    if ($cors = "truepost") {
/ @" G  z9 R! c/ P        add_header 'Access-Control-Allow-Origin' "$http_origin";
' a) c8 v% @$ h6 o        add_header 'Access-Control-Allow-Credentials' 'true';
/ G5 s' r) p+ G. m" w0 n        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
" e7 a( K% L0 T( ^/ s        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

}