Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
1 Q. w! b* S+ a8 u1 k" V6 o: e) d, E1 d
) L6 Z! M- Z9 z( H

# CORS header support
#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
/ z  r3 I: n; l) Q* ^# statement inside your **location** block(s):
; i# ^+ k2 m* d9 i/ I5 ~( V- H% D2 S#
#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
9 c9 v9 W- D- K! b6 E; X3 f#
& n" x7 Y. g/ _' L9 T$ ?6 F! S# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#

set $cors '';
) e; T& M3 e) Wif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
}

if ($cors = 'true') {
9 q" V  D1 q- \2 P1 I" J& T' N        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
- ]9 m& L# b( ^# n7 P7 T1 S3 D
if ($request_method = 'OPTIONS') {
9 u$ F5 L; ?. V" w0 X  C% A! o        # Tell client that this pre-flight info is valid for 20 days
5 m# |3 |$ X; e! S- G7 u        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
6 y4 E: f! {' j2 }% S: H        return 204;
: {. ^' f- k' _/ D" H9 }; w& m5 |}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
( c! Q, c! R# L* h( F# }

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
6 X( _. {0 Z# L1 z, g}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
# t2 Y0 K& \% ?5 ]1 N1 v}
; p5 f+ X9 n4 [3 g  y7 dif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
& Y2 c* u0 i5 s2 }: H     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
3 t/ \/ `5 J# N+ e* U& P* }5 K     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
% }6 g4 j* I% C0 s. u     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
: ]6 t: x* U% y5 V1 K     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
0 y! ~* ~9 R* }: b6 P* x}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
1 q) S6 l1 F" o$ @/ h, W#
# Slightly tighter CORS config for nginx
- w4 y# f$ ^5 @. M7 K" m4 N# C9 d#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
8 f( V8 ]) f, M7 G, N! u9 l# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
1 ?# Y  a0 ]' h1 M# `( C) _# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
- X. c& C6 E4 r# y#
7 Y& f8 l* w- x$ s2 l# NB: This relies on the use of the 'Origin' HTTP Header.

location / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
6 e1 H$ I5 n7 Q& U$ q- S* H" T    if ($request_method = 'OPTIONS') {
+ j+ R1 l5 V2 |8 w: C        set $cors "${cors}options";
1 W* N! n, G: N, D. T    }
6 ^3 {: J* c2 Z& b    if ($request_method = 'GET') {
        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }
; N7 F: `4 Y3 n" [* U* ?, M
0 g2 y  F: |6 Z4 W4 m% U, m5 l0 A    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
0 g/ |: O( H2 X        add_header 'Access-Control-Allow-Origin' "$http_origin";
+ |: J) O7 }: c6 b. D. m    }

    if ($cors = "trueget") {
7 n  A/ A9 i: y4 e        add_header 'Access-Control-Allow-Origin' "$http_origin";
: W2 g- A+ j( L        add_header 'Access-Control-Allow-Credentials' 'true';
! C2 f1 n* [* O% c0 y4 k) t        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
/ G) V% o( _% T0 l3 o, P        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

    if ($cors = "trueoptions") {
3 l- A* n* `& n& n5 a  t4 G        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
        # Om nom nom cookies
3 Z$ w1 y4 {* b        #
        add_header 'Access-Control-Allow-Credentials' 'true';
" K  i* h& h( U+ w) N2 ?        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

! I& ]; o! ]8 c2 e3 I0 M        #
        # Custom headers and headers various browsers *should* be OK with but aren't
0 [  ^2 T, O$ p! r' R+ B9 w, r# K8 Z        #
( j- _  ~( W. x: ?! t* }  ]        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
        #
- [9 t7 E8 b8 W5 U        add_header 'Access-Control-Max-Age' 1728000;
5 t7 f4 ?3 X# b9 S7 k5 Y2 N        add_header 'Content-Type' 'text/plain charset=UTF-8';
. g' L7 Z; l5 u        add_header 'Content-Length' 0;
        return 204;
    }
5 O4 y9 x% R( {; Z* e. S
4 f6 e  R9 `9 |8 P  r    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
9 |/ v; {/ o& n7 g( r) u; o6 u        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
  u% `9 T5 {/ D% W! P* u        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
. k) m" U1 @" k; s' l4 @    }
- b- T. R' o- L6 P# `* j
}