Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

tid=101068&以下是gist.github.com支援reverse proxied APIs的範例:

8 c7 T# {# T, e

# CORS header support
#
+ |+ w- G+ \' e' K  s# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
# i1 a; m' }% t, z& w: z3 l#
#   include cors_support;
#
% `( Z5 S4 L# _# As of Nginx 1.7.5, add_header supports an "always" parameter which
2 I* N! U0 h2 W4 V! d; z# allows CORS to work if the backend returns 4xx or 5xx status code.
3 r" x/ |) z9 y+ B: P" g; f( N#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
8 P# W) f% v9 W9 Y& N# u
set $cors '';
4 j- o+ _3 [7 @& |if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
$ i/ H7 c7 [- Q0 |, {% r        set $cors 'true';
6 E. ~8 K1 j9 ]* i8 t) L' w; K5 ?}
! a( a* ^- a: W% Q' Y
1 x) \4 m5 K0 s/ \+ ~) P* Pif ($cors = 'true') {
& l' M; ?. N( K  \+ j        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
/ T  b% V3 R  _; D0 J        add_header 'Access-Control-Allow-Credentials' 'true' always;
, j: `+ g* Q1 a2 ^        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
& k5 _2 R# g* j3 V# v( t7 O        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

$ T( y0 v' w7 Z% ^' }8 f% h) cif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
  I: o- D3 |' R5 r) _9 ^5 B        add_header 'Access-Control-Max-Age' 1728000;
6 H1 m4 Y! T% }" X8 `        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
5 }' p2 c" A* R" |5 m, X$ w+ n        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
9 [) v$ G3 p' l( Jif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
4 Q+ d+ n% h3 V: h# h- [     set $origin 'https://default.yourdom.zone';
2 o' E. S9 C* R3 C' K" {: W; a3 X0 k}
) g8 n/ r' G! u6 U3 f( o+ N' d3 Pif ($request_method = 'OPTIONS') {
6 e, p, [) Y' O* Z     add_header 'Access-Control-Allow-Origin' "$origin" always;
" j1 m# _& c( O$ U# |& s8 e1 @     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
0 u8 w0 i& ]3 ~) W$ {     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
  l! o- d7 g1 y) e: B4 f; I3 G     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
- ?% {# @+ M& |- X/ \" u9 i" `     add_header Content-Length 0;
     return 204;
- H" I4 C6 k. [; I/ @$ \* Z# @}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
# E0 |, x6 @* F7 c0 D7 W+ v5 t8 S     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
" A8 j9 h7 h; X0 |$ N     add_header Access-Control-Allow-Credentials true always;
9 C, I) }' u1 L; _- C}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
* K5 O" {$ z( E( @+ K! B; A#
2 z0 H' n; a+ H& V- F# Slightly tighter CORS config for nginx
: _) Q+ e$ M* u# B1 \) u! {#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
2 h" o7 R; x# U! a$ _#
& g2 x0 Y6 n0 H3 h# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
3 E) i: `4 u* y4 T# method to control access instead.
3 J/ w, n1 I- d! t$ k" K2 N" j#
# NB: This relies on the use of the 'Origin' HTTP Header.
& w  }4 M) F4 @) t/ C
location / {
5 n6 X- x0 C3 ?8 l: l5 B% r
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
; k- P8 K/ F" I" D/ z* W
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
4 t: f$ P6 ?5 ~* Q( _    if ($request_method = 'GET') {
        set $cors "${cors}get";
- q5 s; n- o1 I) g; h$ S; u    }
5 z: R; g. K' ~5 }8 q9 @    if ($request_method = 'POST') {
% s2 {: D& J0 K: P  `. Q" u        set $cors "${cors}post";
: n- u( N5 t. A8 [    }

0 q/ H% H1 l6 T; r/ Y    if ($cors = "true") {
& S  L% Q0 ^( {" e9 A. ?( [! c        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
$ g; y1 r% I9 V: c9 I( I
    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
3 I  r" q8 {1 R, j( h        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
4 s, o, `: q( g/ _0 V% C$ @
    if ($cors = "trueoptions") {
' U0 `6 c+ q5 A0 _        add_header 'Access-Control-Allow-Origin' "$http_origin";
" g) F$ K! n5 n$ g: n; N/ H4 d
, m7 z! O# [5 H% {+ V        #
        # Om nom nom cookies
! c4 B5 f; D9 \4 @) Z& O        #
        add_header 'Access-Control-Allow-Credentials' 'true';
" _1 t; S' i+ ~1 w        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

9 v' @  i8 l. D. R9 B7 g+ U        #
        # Custom headers and headers various browsers *should* be OK with but aren't
! {7 i) t( R/ T  l        #
9 B' w0 z; j- f        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
, K* W7 j& h( f% b" H
( f6 {! [/ v2 \$ \1 O3 ]        #
' U' [2 B2 O3 J" A: e  \$ x( ]8 A0 W        # Tell client that this pre-flight info is valid for 20 days
! H5 q& d5 W/ p7 s0 N        #
9 Y- x- ]- O1 `( L        add_header 'Access-Control-Max-Age' 1728000;
* K' l* s& T* T/ ?        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
    }
$ N6 x: B( B# \" B
) Y, ?, `( b  a  M- \    if ($cors = "truepost") {
1 z. `$ ?( _; c6 y        add_header 'Access-Control-Allow-Origin' "$http_origin";
/ v5 D; X6 I3 j) |3 v        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
) v8 ?  Q- C7 X' }( ~/ r; u    }
) m# @  o0 v& s  P
}

. B: H' w+ U) {$ l+ L3 I
' t5 g8 Q) K5 H$ t$ j. |, T! v4 k