Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
/ r& u+ ~  [. s. F" i9 D
$ q3 u$ k! q7 t7 j  ]

# CORS header support
#
$ \: p( z: Y1 }3 {$ p7 z3 u- B" X# One way to use this is by placing it into a file called "cors_support"
3 I6 Y- H) ^2 t" _# d# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
  r2 a1 s" H3 r  o2 `+ o0 Z) q* J#
8 R' f$ I+ ^; U$ x5 F9 n" S6 {9 m#   include cors_support;
1 a* F, E+ ^) u5 {1 Y/ t+ D% A8 E4 o6 Q#
$ Z( s' I) u2 f# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
6 G5 ]+ q4 u6 x# u#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
& }2 k8 P5 G/ ?' J' f# M#
! l0 U7 R/ A1 y! N# ?- }8 D
set $cors '';
, T, p* E( s" h& \# Xif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
4 s6 l5 k' w2 I( q' f- R6 @        set $cors 'true';
& @9 F, M& G: m3 N}

5 {# f" `" d' |if ($cors = 'true') {
) D1 }. c! R5 U$ W  X2 B* v7 m" ^        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
% I* `/ i2 _! x. H' W        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
- j: M* d7 @: M8 l" z        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
! Y2 i9 ?, }, y        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
5 S, i) N  v% M9 E* J}

if ($request_method = 'OPTIONS') {
6 x8 V% u- z8 b! ~1 d        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
1 c; @9 Y  c$ l3 `  R7 j' k  H4 w        add_header 'Content-Type' 'text/plain charset=UTF-8';
4 L8 ?8 m# R! J1 V  `! b9 p% w; R+ V        add_header 'Content-Length' 0;
5 b# t8 U6 D. m# c        return 204;
9 l& Y& x* t4 _6 S' |$ I2 G% h}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
; P. X1 H9 n& p7 t) y: g; X}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
  ~: x$ b2 ~" Z# |if ($request_method = 'OPTIONS') {
" f: L. h7 D0 Y: Q7 j     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
* Q* B& N" @. h: P& t9 z3 \  v     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
! h- V0 D7 L! R1 N6 r7 N  A! O     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
: o8 o  l. I0 H+ `' F7 G     add_header Content-Length 0;
     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
& H/ {7 K2 L, u/ m$ A     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
$ c* W( j/ f- ~0 b5 d     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
' d; m+ {( C" m4 e( ^0 A) e& G}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
5 Z7 ^5 j0 k# k* P8 u#
/ K1 k% P0 B5 [6 g) l# Slightly tighter CORS config for nginx
. M# l' y! w( J2 ~: |2 l( Q7 S* v#
: m! ^* ]8 K$ y+ X" f( \# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
* K% j2 ~. g% c- r# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
% c' N! r. C/ G) l; n8 D% E#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
. l, _% C- x" d( ^: d# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.

location / {

. S# F2 X! k/ u! R9 H: r    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }
/ h: u: [5 I: B
    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
1 N7 [5 m. j( y  i  D    if ($request_method = 'OPTIONS') {
4 K) C0 R% P4 V! {! i7 V6 {        set $cors "${cors}options";
    }
* t7 F7 s2 f% u. ?    if ($request_method = 'GET') {
        set $cors "${cors}get";
7 D. i/ C) }% C6 ^    }
    if ($request_method = 'POST') {
' _  I8 y8 i" p  ~9 y2 \# |        set $cors "${cors}post";
    }

' L5 C! B: }" B  L, M& _; _    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
; J: T4 u4 G$ ]  }        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }
! y* F7 K' V9 e8 `  G- i: I
1 `: C8 D. y8 Y9 |    if ($cors = "trueget") {
2 u) J5 D0 c( G' J4 m) N4 z        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
4 y4 f, b6 I# b6 ?6 V$ F$ z2 ], N        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
0 X) P9 A. k: ^% a        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
! D9 c5 d5 h' g
    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
        # Om nom nom cookies
        #
5 Q1 w' J0 X% N! G5 D' H        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

0 _/ I# ~3 G6 ]* e        #
* v: [' s) r, R3 t* Z& X0 X0 M. O        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
( j6 O+ |3 l. K% _. ^, V8 D+ O$ ^. A        add_header 'Content-Length' 0;
        return 204;
1 q4 K7 f$ ]. U2 i& i' A/ J    }

8 x3 [7 ]& D3 E5 h- |' W9 {; T0 s    if ($cors = "truepost") {
% g- u' i: S1 v: @        add_header 'Access-Control-Allow-Origin' "$http_origin";
- s2 i) L* A, k( M. f        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
% f* O. u9 g; W5 P1 J3 ?2 ]    }

1 t( s1 W4 V6 l7 l1 h4 `- a( j}