Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

# CORS header support
5 ]  ]9 O9 f% Y! A4 g#
# One way to use this is by placing it into a file called "cors_support"
" F9 a0 X4 u, w0 `# j4 S9 Y+ B# under your Nginx configuration directory and placing the following
4 p3 E  e+ j. v+ A0 b8 \3 @7 x# statement inside your **location** block(s):
#
#   include cors_support;
1 c+ G" q, x- H7 W( Z& j#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
9 M: E* @5 L6 l7 q% E# allows CORS to work if the backend returns 4xx or 5xx status code.
: j) ~3 a6 @  i( W#
4 L. X# S' c! f. p# P8 J) o# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#

set $cors '';
! x3 e5 t# }# v3 v  vif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
% W# J- e5 P7 L5 u- Z, w2 ~        set $cors 'true';
; B" z, u! d  ]2 k}

if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
7 k  g# u7 G$ y+ L        add_header 'Access-Control-Allow-Credentials' 'true' always;
" m( _* e, r0 t# W; |        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
! g9 _2 w. q% O2 \: {        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
. h2 K: j% c" q: Z9 D}
6 C! L# O5 P9 Y% V+ C5 e+ W, O
/ h/ g9 ~/ t0 \1 o: u4 ]5 U0 Y  O) Aif ($request_method = 'OPTIONS') {
/ M2 }/ S+ o8 p4 M0 q6 b) i        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
% _$ b/ d' ~) C/ @" ?  s0 n        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
5 o" a0 O" X9 D! ]

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
: i; S* k, [0 Q  F: k6 H! i     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
9 @8 B8 l& ~) B9 }2 f     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
2 D5 t3 p1 Q* Y     add_header 'Access-Control-Allow-Credentials' 'true' always;
" S  ], q3 {' E  @8 X     add_header Access-Control-Max-Age 1728000;   #20 days   
1 L& o/ C  [4 F2 o2 t     add_header Content-Type 'text/plain charset=UTF-8';
9 ?" Y" U7 E5 N3 G8 t     add_header Content-Length 0;
& T# I- e& H) \. q3 r     return 204;
' N, t0 z, s* y5 {  l) x}
4 L( \) M5 f6 }6 W' o1 pif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
9 f* \4 L1 E6 I( ]" r     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
7 b' N) r0 ]. b$ A' c; k+ L$ m     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
8 N" X& t8 ?  `9 x# Slightly tighter CORS config for nginx
#
" x: N# V7 w1 b  R5 E# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
9 H' h4 a7 N& X5 M# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
4 _& a- b. J, I" m8 s% ?#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
3 X3 ~4 K/ h& n1 O# method to control access instead.
#
# x& s' E% Q3 N. N# NB: This relies on the use of the 'Origin' HTTP Header.
, G5 D- @8 ~5 f, w/ n  Z
location / {
9 m& k* r5 @5 M' w9 c
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
0 e& n5 f) A" ^) y  C) S9 U        set $cors "true";
( U) o  A- P9 i- @' C; `    }

0 g3 ^1 b  F: \6 }$ O; i% D7 o) }    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
/ u" G: c6 G8 G; I; F    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
- k4 q. q% u8 N        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
( a6 |5 p1 y9 V8 o; ~: J' R9 [        set $cors "${cors}get";
$ u2 |0 Z5 ^, U    }
. w# P4 P8 V, i- Z2 w. |    if ($request_method = 'POST') {
6 f- S5 U" k& @+ }, X9 Z' R/ \5 Y8 |" b        set $cors "${cors}post";
1 ]+ ?+ G9 C1 B: V. m    }
/ C2 Q* m3 x1 f/ d- ^; O) o" `
    if ($cors = "true") {
+ z* D+ ^$ q( X! L  H5 M        # Catch all incase there's a request method we're not dealing with properly
, i# w- W/ _; o& P% v4 f$ S/ m        add_header 'Access-Control-Allow-Origin' "$http_origin";
# G( f+ F2 E) w: p    }

* q  R9 l: }1 V    if ($cors = "trueget") {
( b2 O+ i' \+ C3 x% h        add_header 'Access-Control-Allow-Origin' "$http_origin";
+ @5 E& B! f- m5 ]+ g2 L+ Z        add_header 'Access-Control-Allow-Credentials' 'true';
/ b5 U. V$ H- ]        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
% J) F- J# a% t$ V( G, A        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
- e( d2 E  ?" J# U    }

1 i' [$ C" a" J; A* N8 Y" @' [% k    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
        # Om nom nom cookies
        #
. x1 d8 K! ^+ f: z( A0 M, M: N        add_header 'Access-Control-Allow-Credentials' 'true';
8 X$ M6 A6 ], q# ^) b6 s7 T$ ^        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
( q9 L. K" U+ w1 w1 L0 I0 H
        #
: m  c0 p5 {3 S- W9 a        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

- f7 R2 A5 C+ p% @        #
        # Tell client that this pre-flight info is valid for 20 days
        #
8 V% i) j9 [  S9 K        add_header 'Access-Control-Max-Age' 1728000;
. z! X. {9 f' I$ W        add_header 'Content-Type' 'text/plain charset=UTF-8';
6 ?' K$ T+ S! v6 Z% ]# q, Y+ E. f        add_header 'Content-Length' 0;
        return 204;
    }
' y8 q6 v. p" e8 ?  Z3 `
; Q0 Z; i. X  \" c8 s    if ($cors = "truepost") {
# t( E$ e  p. @. E        add_header 'Access-Control-Allow-Origin' "$http_origin";
+ K# }+ |( x) q9 P        add_header 'Access-Control-Allow-Credentials' 'true';
1 Z# f6 F) K8 s2 ~. o* j) ^        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

( R) x6 d& O0 C3 U}