Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
& w+ [. C9 s; }1 i. h6 F
4 T* F- o0 t" t% U
/ j  ?3 U6 E: N: Y. r

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
) o8 V/ f& |) ?: l) d# under your Nginx configuration directory and placing the following
# }8 U; z$ n5 j# statement inside your **location** block(s):
- O& D6 W( F6 f  x; {, m* }5 h#
#   include cors_support;
7 H; i9 k( F; g- L4 n#
( a. P1 {& o5 B! @$ y# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
8 a. L  L8 n9 t* \, t4 _, D#
+ N$ U  _5 z' O/ L* e! c# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#

: T# S) f2 w  |* W7 `! Lset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
9 a/ b7 j/ X% F$ |" J        set $cors 'true';
}

/ F/ w. E% x' l1 S% ~% r. q. d1 uif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
9 ]* ?$ R( Z. M! Z+ r        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
+ C* `! i/ [! \# C& Y        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
2 u2 X6 r9 u4 z4 w* R9 c        # required to be able to read Authorization header in frontend
* y6 s. X1 {; K2 n; F        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
4 Q" P! P. w9 @  S, V' i
4 L6 ~& J1 j+ N6 Yif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
* r; q% ^2 l5 n) D. R5 V. S0 W        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
4 O5 P# X" W5 M0 p# u5 U+ d3 J

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
" W, \: L1 g2 n: D  N$ P/ Uset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
" F& i. o  _; N% K/ J     set $origin 'https://default.yourdom.zone';
7 e5 k" P% v2 b8 {1 n0 ?}
5 x0 w, v  x" Q1 U$ |if ($request_method = 'OPTIONS') {
2 d: {( ^. c# N) G" j! u4 C     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
, o9 R1 J# R8 @: z     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
8 X( S! t- [& B$ F' a# {     return 204;
5 ~3 t" J6 b8 `, I% d2 q( q}
0 l) f7 D7 K0 N) n( @6 s4 Cif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
: o8 C5 R- n4 f8 W4 \' O6 E     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
# h7 e8 V3 a1 z8 @* C. h% ^/ D$ D     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
4 a% V+ N' B3 j9 S) y9 `#
# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
4 K1 P# C0 m- w0 v# don't seem to play nicely with this.
#
) s5 d% f* f$ T. Q6 y* q# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
" Z+ @$ J, ~$ V7 D# G# A1 v: i# method to control access instead.
8 B6 T; z: X% ^/ p#
. \- R& |2 U/ y# NB: This relies on the use of the 'Origin' HTTP Header.
: }9 a& P# y; I$ J
location / {
" \- k) p% W; J& M$ }5 u
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
" H) Q4 @4 b: k. q1 a7 @( G        set $cors "true";
    }
" l' I- m1 Y" H: B8 Q) B
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
3 V9 z+ b4 u: a1 l* e* M( z& F; _        set $cors "${cors}options";
    }
2 m+ C1 b6 Y- q# O8 `3 |9 f    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
% q7 U- @6 ^$ h; F    if ($request_method = 'POST') {
        set $cors "${cors}post";
% s- y; R" T# l' v8 g' p8 Y7 P    }

$ r" W+ `% }/ f( Z3 S    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
( Z$ s+ X* r- a3 W' _' F: O! E8 V    }

    if ($cors = "trueget") {
2 I) F! c! Y3 O1 J, N        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
4 \& y( z2 ]+ H        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
% n( U- t4 C4 d/ t+ [        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
3 J* |  H  }2 R9 @! |2 j    }
- ?) Y- W& o# C4 p5 {  V/ ?
    if ($cors = "trueoptions") {
7 H+ r9 c. ?5 Y1 t7 c# |# P        add_header 'Access-Control-Allow-Origin' "$http_origin";

) a* R: c8 e- r  Y5 e        #
        # Om nom nom cookies
  V% J" r/ I& m' h        #
! t( c3 f* ^/ I5 m9 B        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
        # Custom headers and headers various browsers *should* be OK with but aren't
8 Y' B' _5 d  t5 c9 s) ^, b2 h; g' O        #
% Y! D$ c: A* u$ j: W        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
8 R. {/ S+ c: O7 L' a
        #
* y+ \& Q  R3 u        # Tell client that this pre-flight info is valid for 20 days
& i6 q3 ^% U6 l8 B2 W/ h" A        #
7 O8 e3 S# R" ?# z; s0 x        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
& d; p& l/ j% v. ^0 t8 ~2 ]& i        add_header 'Content-Length' 0;
        return 204;
. g8 U3 c6 m) i& i    }

+ K! p4 B, T: c+ J0 t8 S; A    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
8 C' t* j* D4 }8 w        add_header 'Access-Control-Allow-Credentials' 'true';
+ I) Z6 P7 T7 r! T( |        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
( [1 |* G( n+ p
- E) \0 v5 h* v+ E# ?# q9 n}