Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
8 {, p$ q) C- g- }6 O3 d" @; |
# O4 c% b! }3 W7 ]. {/ {7 }
! Z( }& h& u6 S, O" U3 \

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
& z, v2 P' E5 {9 b% [# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
#   include cors_support;
8 E  @# c/ H& R8 c  D8 p5 t% F" z#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
) m7 n$ b, `6 T2 Z# X& e#
# For more information on CORS, please see: http://enable-cors.org/
2 a5 c* x9 Z+ R1 z# Forked from this Gist: https://gist.github.com/michiel/1064640
" s+ ~5 ~8 d3 h9 z#

set $cors '';
$ j+ G; Z8 u4 R# K- }if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
}

5 F; A3 u# r$ E* g) kif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
) X1 B+ h7 S$ ?4 L/ e4 P1 _5 m        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
- K  J9 b$ R# y. s        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
) S) B2 _; ^  `1 K* u}
/ n( n; O: W  M" c4 t$ c: B6 c7 x8 w
: {2 l; V/ v8 D  }+ I) bif ($request_method = 'OPTIONS') {
1 L( a" f/ Z. T) @        # Tell client that this pre-flight info is valid for 20 days
$ e) D" F) B7 a5 i        add_header 'Access-Control-Max-Age' 1728000;
! E0 d1 m# m/ `$ t8 R        add_header 'Content-Type' 'text/plain charset=UTF-8';
) O' o% s8 S$ X9 j; X" c; a        add_header 'Content-Length' 0;
8 h# d& u/ Q! V        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
8 _, s3 Y+ d0 nset $origin $http_origin;
% r6 J# l" a  F  [3 e2 ]+ V; Bif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
) q# {0 }7 t, Y) e}
if ($request_method = 'OPTIONS') {
& L! b) g$ y0 ^3 C     add_header 'Access-Control-Allow-Origin' "$origin" always;
5 z6 x6 ?. B4 L* P; ?+ L     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
8 O" z5 _/ D( E7 i% G     add_header 'Access-Control-Allow-Credentials' 'true' always;
" L! P3 x0 k. Q     add_header Access-Control-Max-Age 1728000;   #20 days   
$ E5 m. Y) G6 B0 D# _     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
3 W  @2 }" K2 P' x+ S* L}
, j% p' J( z$ D+ a9 Lif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
9 V* V; d/ ]. d5 a, H     add_header Access-Control-Allow-Origin "$origin" always;
6 c' f- Z, X& Y     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
. T/ ]5 _5 P3 d#
1 c3 ?+ u( o& S6 _) Q# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
2 j& v1 N+ N. R1 I; v7 ^#
8 H' P1 j) p7 }  \0 G& S9 @8 I: N+ O( H1 U# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
3 M  F! R* m2 E2 ]3 Q( c' S8 R, v#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
( l5 g1 E7 d: R2 G# method to control access instead.
; a# \/ L: e! [# Q- A; Z* J! S3 z#
# NB: This relies on the use of the 'Origin' HTTP Header.
& |- n) B/ }) A9 T
0 A' c0 ~$ Q: ?- z. g6 b$ w6 h4 V. K; ylocation / {
7 {* p* E4 E; y& \
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
, v) \4 H( w+ i5 @3 B+ T: q        set $cors "true";
: m) @' \; n3 p; l- w) L+ b- u    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
% Q5 A+ z# u- x. `% G+ C    # Determine the HTTP request method used
  w* s$ u3 r% R, D    if ($request_method = 'OPTIONS') {
$ ~. k9 c" L9 v* `$ W* s+ q        set $cors "${cors}options";
9 f% k4 J, S) I6 L- u% n: }    }
    if ($request_method = 'GET') {
' v  |, ]" R; p: z! s+ L! f8 G        set $cors "${cors}get";
    }
& J! ]6 }- s( C9 \# Q( ]% i' p    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }

    if ($cors = "true") {
) }" ?5 b: `$ V" l! a( i        # Catch all incase there's a request method we're not dealing with properly
; w8 h0 j. }4 b4 P  `7 j        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

& {* T: @  ?+ o; u$ Z    if ($cors = "trueget") {
% N0 n# y) u, ?" I        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
- T( Q3 J( {9 l1 e1 ?- p        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
5 `5 {0 y. e3 e+ x$ h0 B    }

    if ($cors = "trueoptions") {
! @1 `3 w5 `( L        add_header 'Access-Control-Allow-Origin' "$http_origin";
$ u+ t. ?" i# b* r
+ G; q' X) t1 _) J        #
8 K, r% W- U( G( ^3 U- f        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
3 t+ x3 N  r- g  W( m( y        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
6 y5 b  G" G3 I
        #
        # Tell client that this pre-flight info is valid for 20 days
5 p, L1 N, v- Q        #
# h/ k4 B% P/ }* F        add_header 'Access-Control-Max-Age' 1728000;
1 n0 W# M- i) Q' V# ^        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
    }
, @" V4 u% y' M' @4 L8 x* i
! G# z+ l  V9 A5 V+ P: Z    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
* |1 U) U9 k, b. F0 K. @        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
  d: \/ [$ S, G# i. N" F    }

  f* ^, f2 U" `7 C/ }! D# [: c( ]}