Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

2 r+ O5 H9 z0 c; L2 \  a0 W
; i& s% P$ F& I3 z7 x

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
2 k0 K# l+ y, ^% ^# under your Nginx configuration directory and placing the following
0 T' ^5 N5 y% ~$ p: I/ S% ^( c# statement inside your **location** block(s):
#
9 |) ~% f& G, Q. x$ K#   include cors_support;
* F( J) a5 E' X% O, Z. N. c1 E#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#

set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
$ ~& P" Y3 M4 p6 C8 K}
4 t% K7 U/ n! F4 l+ [
( \# @# m1 ^; P$ ]8 Mif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
) i( W7 k% h' i! A- P7 O0 n0 x        add_header 'Access-Control-Allow-Credentials' 'true' always;
9 ^% [8 Z( A7 h: O" N8 a        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
2 q, V8 I3 ]) B; H- a        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

/ R5 m) a$ x- W* H5 Pif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
  L& z6 x* z% k        add_header 'Access-Control-Max-Age' 1728000;
0 M# {& D/ b! f5 I0 C5 c% k3 F        add_header 'Content-Type' 'text/plain charset=UTF-8';
# o: }' h, H/ P. k  L. I$ s        add_header 'Content-Length' 0;
: g) Z" M- T+ I        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
' c( q8 n2 u8 l- @9 g

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
- W3 L6 t# Z  n}
9 ?( Y5 D( I% H9 Wset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
' j8 w0 N3 ]) F# S. \: k     add_header 'Access-Control-Allow-Credentials' 'true' always;
) y- A6 c8 r: \! \" d     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
  }9 b! u$ _, A+ S5 `     return 204;
" r# t0 ]# R: j}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
. F* e4 J% g% h- ]  M0 c, K     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
$ g( P+ V9 y+ p1 I" H! \+ o     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
$ B3 O3 ?( W1 n0 |# ^}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
% Q0 Y' M3 n: R# g#
# Slightly tighter CORS config for nginx
8 N* w5 \, F/ P: }8 r) A9 N( ^#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
0 M0 t7 y( h: z7 |; n# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
2 {; p- n" W( w* {2 i# don't seem to play nicely with this.
9 a5 F  v" f: l2 p/ v#
% c. w. _0 V0 |: }& A# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
4 A6 _3 F" x# H! Y) [8 n5 d#
' G: t, B. N. t* T7 V: ]# NB: This relies on the use of the 'Origin' HTTP Header.

location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
$ N! K2 F2 y+ ?! [6 T; O        set $cors "true";
' r$ v  T# L( d$ |$ w    }

: m* o6 N' o1 z    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
, i; o- E$ K& m: Z9 C) R! d) y    if ($request_method = 'GET') {
9 N# s" D& Y+ a; s9 X        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }
* f; [& K, N+ k
    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
) _, r5 l( t0 l1 g1 m    }

    if ($cors = "trueget") {
, G9 a- y- c; ?        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
& H' Q1 j9 z' [2 {6 q% f3 C    }
; o- h- c, b* k0 \* `" i
# m. t5 r- E% t/ u    if ($cors = "trueoptions") {
1 r6 \& r5 y& T, w* G0 A        add_header 'Access-Control-Allow-Origin' "$http_origin";

& e* y+ Q+ H( _, w" b( L        #
        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
- s/ z' S9 Y" S2 l  R        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
$ \' v4 [; t' [" y# m* M. V3 o
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
/ k, G$ e+ a" ^5 G3 T        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
6 j; k0 r* J" i, z* H  ^
        #
% H  P. a  j& S0 x9 @        # Tell client that this pre-flight info is valid for 20 days
        #
+ t9 g9 T9 D. U8 L        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
% v  E. ~2 `  I0 e- ?3 z: H* A  v        add_header 'Content-Length' 0;
        return 204;
    }
% J* s, w! R0 S1 I
2 R% }  k" e1 P# h+ H, M6 Q    if ($cors = "truepost") {
8 z, \, t! y% }! S) z+ d        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
4 H* j/ B1 t4 L* H( y/ [        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
7 F7 x' a! e, {+ T! A) e+ |8 S2 h
% C- F) Z" }8 m  p# n: p" l}

6 y; o/ x- i! |( b% s9 T- J; N
; K+ c# r1 w7 ]4 [1 m