Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

2 K9 U$ G$ u, I/ L3 z2 X
/ O3 o0 j: I; V5 {- W: m2 }0 Q

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
1 y, U" [  g' a* t# under your Nginx configuration directory and placing the following
7 W# p! W( [% m+ E; ]+ W5 ~# statement inside your **location** block(s):
5 M+ Y; w3 F3 C7 y" g7 b: F#
#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
: D1 j0 z  T, u" _$ J#
# For more information on CORS, please see: http://enable-cors.org/
& p: f3 z8 S# j2 y6 I) u0 b: t* d1 D# Forked from this Gist: https://gist.github.com/michiel/1064640
3 o! ]  Z/ j( P# ?9 X#

( V5 l& G1 K6 R3 Y5 m  \, Hset $cors '';
2 m  _0 E) a0 tif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
% _. g- u/ J$ W# p        set $cors 'true';
& d  j  S# ~0 ~. x' W}

! K" @: x8 f( n7 {) Bif ($cors = 'true') {
1 z' }3 C2 z- y; [, c0 d        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
" T  t' k  C  A, y2 |7 @, Y2 H* y* n        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
/ G  r. {& R6 B+ ?) L% p+ @        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
' d. [! h% J5 s0 D6 K' L}
. S0 _# V2 h& n9 t, U
, M/ @/ p5 Z* i/ t) |if ($request_method = 'OPTIONS') {
2 {+ [* O4 W! t  _- k; w; z        # Tell client that this pre-flight info is valid for 20 days
! i& ?2 ]6 K& f* ~: O) H! U, V        add_header 'Access-Control-Max-Age' 1728000;
; }  h7 P$ S" ]( F9 d        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
! y8 K8 _# K) t' x# V$ H}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
1 B0 {9 e& C- X: s3 ]5 I* k7 h; Q8 |}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
+ E) `# T* V. u( ]' N     set $origin 'https://default.yourdom.zone';
}
8 N( b7 p/ x9 ]if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
9 r. A, y& J# a     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
5 a3 }3 B0 P; N0 f8 D2 m4 Z: I     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
( f! I1 c( s: U, n& E2 _# v) j     add_header Content-Type 'text/plain charset=UTF-8';
5 V  n- z, s. b$ @& a! A     add_header Content-Length 0;
     return 204;
}
8 l9 m" H$ F9 R- iif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
$ O2 x! w! K) T3 h, H& N     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
4 d, A7 G" @( L! V#
! Z: v; H  _' ~# L; M. h* g3 Q# B# Slightly tighter CORS config for nginx
' _' t- ?5 V8 Y9 b% I) J& H  u2 X#
7 k$ k, `$ `$ T# Z! D5 p& q# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
: u( `7 d& P9 }#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.

location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
' o( n( Q, {  b. f        set $cors "true";
    }

8 o" V: O  ?. @+ {    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
4 T9 J$ x! H5 i, d" p        set $cors "${cors}options";
) M, _: }7 k4 F* n2 Q    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
0 T9 b- @) S, ~0 I/ t    }
! `+ Y  `2 w' D4 m/ m2 V4 F/ Q8 B    if ($request_method = 'POST') {
/ j: _  e3 c8 K* k        set $cors "${cors}post";
    }
5 C# `5 k( s% Z; L4 E$ @+ Z
6 d- E0 d) U/ f0 c# R1 _3 Z    if ($cors = "true") {
- s) t! e: h; I/ T" C; d  V: g. E' a        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
& Y% h) |9 q& S4 l- i1 [    }

    if ($cors = "trueget") {
  m4 a5 Q  @7 W1 }" R        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
# ]' a7 r; X, N; j8 K! F        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
# u/ K4 K* i- f, ^
    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
5 r& h. K0 W3 h# U# b/ C
7 m# h& T; N# G' k2 H! a$ v) q7 x        #
$ v  A) R7 U1 t; n" n; |        # Om nom nom cookies
9 F0 F- T4 P  I0 n2 V5 O) t* ^/ f        #
0 |8 ^7 B" c! n- `, a7 V2 ~        add_header 'Access-Control-Allow-Credentials' 'true';
& Z8 b! Y- |6 W0 E. N, Q# K; K        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
5 C9 m& P( V. x3 x
        #
% y2 V! P- c1 ^0 M3 @        # Custom headers and headers various browsers *should* be OK with but aren't
        #
4 c# T+ [6 j# w! M# K( b        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
5 q+ t$ y  m  u& r( g3 Q" w% i        add_header 'Content-Type' 'text/plain charset=UTF-8';
6 g: d/ R. ?+ \; j1 v* |& r        add_header 'Content-Length' 0;
        return 204;
    }
3 k$ k! ~# O3 {1 P, m
    if ($cors = "truepost") {
$ q( b( c9 s: }7 U8 Z& \/ d        add_header 'Access-Control-Allow-Origin' "$http_origin";
8 Y; c: T. k, x' i9 c        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
0 f6 U0 P* |7 p& h$ Q3 _    }
; G" a9 U9 d& i
: ?0 y8 a( D. Q7 M7 |}

1 f4 S3 Z) g& {& ?
: Z6 m2 h! n7 R! ~8 F4 [. L