Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:


+ R0 `  X. w0 q" V! _  Z" o

# CORS header support
$ T  m( U# K$ J5 |! s9 ^#
# One way to use this is by placing it into a file called "cors_support"
/ l- s; k2 Q; B# x# [% w$ `, |# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
- E- |$ N8 o9 |  Y#
( m0 x+ I' E* Y9 H5 {#   include cors_support;
- r/ h# D$ r3 r' i4 h  C: v4 B" g#
$ b" z$ d- e1 j# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
( N' z9 W3 t2 D- q; f3 c( C2 x#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
! r- j* H$ N3 ?. P5 N- A#
- ^) x# A. q0 O3 `
set $cors '';
8 |! K, y$ M. U5 d0 t5 r2 Pif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
% s3 r/ x7 U5 E, E7 Y% B5 ^4 i        set $cors 'true';
6 u6 m/ g$ y. a4 P* }# W}
& F* P, `; E3 ^# H" ]( r$ @# R
if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
. `/ ]& \1 T/ [7 t        add_header 'Access-Control-Allow-Credentials' 'true' always;
( u  {: E2 S' H3 H, W) l3 i5 [$ m        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
# Z$ K" H- p+ x) @* L  X        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
4 ~5 J/ N# h$ ?% x# b7 b" k! [
if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
/ J+ D, p# p$ y( O; S        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
& r8 g8 j) \3 ]- y. u        add_header 'Content-Length' 0;
        return 204;
$ ^! y" T; c% z; M+ M# n" I}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
+ T1 ]. f3 @2 q, x# n# s

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
# p8 j- B! n; v8 r8 ^8 {7 Bif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
6 N, c2 F9 r1 t6 b- {     set $origin 'https://default.yourdom.zone';
8 H  N& f( [$ s% m, K( g! l' a}
' |( b' }6 {+ g4 o. E/ H, zif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
# F- r5 g; ]" d1 g, R9 j- D$ V# Y     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
9 v+ j% d4 J% `2 q  O  B     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
, y8 Y) |) x' e1 ~7 k3 u0 t}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
( x. S/ I4 D9 n1 X3 F/ V     add_header Access-Control-Allow-Origin "$origin" always;
. C7 D* z: I4 v$ w3 L     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
) g/ q! Z. g1 l/ p  ^  v     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
* l0 Y* c4 ~6 P7 [     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
- O3 k$ A+ Q# G4 d#
- q4 h% C& k8 Q# Slightly tighter CORS config for nginx
#
# y- ^2 Q7 W( D6 e7 M$ O0 M# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
8 C. i6 b$ j6 G. B" X' v#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
6 M* B) e% l8 X5 U- X4 |$ ^# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
- T5 }& t3 Y! T& r1 q- U#
6 o' @6 g# O0 X8 m# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
( J3 l8 y* {7 l/ h# O& i6 m7 \# method to control access instead.
#
" r( Z- g  c! Z) |0 B+ Z# NB: This relies on the use of the 'Origin' HTTP Header.
) n1 o9 I! j- R" a
location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
& s" e$ j0 |9 o    }
4 e9 S( _) ^8 Z% @
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
# k( V0 E+ _9 M2 f: ]" \4 u    # Determine the HTTP request method used
$ y3 E( w+ r% m) A    if ($request_method = 'OPTIONS') {
5 k& I/ {! F6 p7 U) g        set $cors "${cors}options";
    }
/ f5 n. P3 e3 |( {! X    if ($request_method = 'GET') {
; @0 O& P; P1 K5 I* r$ N. _6 T        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
$ Q& G, l) G$ q        set $cors "${cors}post";
    }
# y9 |" _. G1 a: F- d' j
    if ($cors = "true") {
% A% g3 `, T( z  @, I        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
) g0 o$ H  I5 w3 {* H* o    }

& l- X- v: k+ ~    if ($cors = "trueget") {
: Y; c7 J( P* N+ y" x7 ?9 N        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
4 x4 Z7 l  ^9 E) P! o9 H% s2 T        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

    if ($cors = "trueoptions") {
) o, [* J; Y* C) L        add_header 'Access-Control-Allow-Origin' "$http_origin";

. y7 o- L$ a5 P0 Q) a8 @        #
+ D& @3 [& ^$ w4 M" z2 y5 x' e        # Om nom nom cookies
  Z* b* h0 r4 s4 m' m        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

+ k+ c: ^2 G5 f4 f4 T) P0 f+ g! G        #
. b& ^! E1 _+ |; k) C- N        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
+ f" k6 B& s9 W
) j7 U" w& i& g6 w$ v* t' _        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
! l* u( r: z. _2 M        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
    }
  y; f3 O" ^  Y8 C) r& b
    if ($cors = "truepost") {
! d4 {. M- q) j3 S7 R2 V        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
: S2 X8 {' O* j# S' y) L- h) E" u1 z        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
; m. ~/ O' D) {+ q4 U3 f$ M7 C* k2 m    }

}

9 `5 p  y; e, P" w