Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

# CORS header support
( }4 t/ [5 i0 i( v6 u$ P2 C1 r: l1 o5 H#
# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
  {& z, w, k0 D! i$ |# b# statement inside your **location** block(s):
#
, ?) D2 p6 M# h: H#   include cors_support;
& i, K6 o7 b2 {" K#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
) x5 g, r0 J" K2 @/ i" E#
# For more information on CORS, please see: http://enable-cors.org/
) M, l# [! N4 p: N# Forked from this Gist: https://gist.github.com/michiel/1064640
#
: T: ]" m% F: f1 i
# @$ q3 C9 u+ |) f) nset $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
1 b, D# J* e2 `  s& j        set $cors 'true';
}

: S+ U% v3 _5 L* t& `if ($cors = 'true') {
5 e+ Y+ |9 o6 n: J8 M        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
6 j% f0 b6 q  A6 ~0 W7 f0 {: i) ~        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
; u8 c' F# K2 v& A- l! z        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
! I1 Q2 ~2 b9 C5 i: @, u% q        # required to be able to read Authorization header in frontend
. e* {5 q6 @" d" W! P        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

/ e0 U/ Y3 a; d1 T' V+ P- i$ Nif ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
# H3 Y. `8 r$ O, H3 L        add_header 'Content-Length' 0;
- h+ D+ e5 h" J$ x5 R) y7 b4 y; U3 e/ H/ c        return 204;
% `% U$ P. m, M, {3 Y- @}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
9 b. X  Q+ _( D& \" Y  K3 _9 A     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
7 ]! A0 S  X8 m" K) n     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
: v* _- e; C' S3 R' T     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
' u( a1 J+ p1 l  B# Y8 M9 y0 X4 h     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
# z6 ]8 P& h% c0 B     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
; d0 g! Q5 f4 ^6 S     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
% i2 p6 W6 y6 P- }9 ~3 t. |     add_header Access-Control-Allow-Credentials true always;
4 t- q0 x' j! Y7 d2 v" X}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
% \$ Q! c" H( x6 B4 I9 d! _  m5 h#
# Slightly tighter CORS config for nginx
6 G$ _5 j3 m, Q+ Q0 k#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
4 I) G$ ^7 \/ z" v# Despite the W3C guidance suggesting that a list of origins can be passed as part of
3 g% F" }. i+ d$ e# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
( @9 L1 E/ W( ^( Y, l: u7 f6 T- F3 `#
3 S1 @0 H4 m! y$ B# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
, K' }' v+ S4 N#
# NB: This relies on the use of the 'Origin' HTTP Header.

location / {

0 g6 Z! z$ |/ m) _% C    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
    }

; T( ]( y6 I  O4 }    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
: Y: }3 d. V) s. c        set $cors "${cors}options";
* J, }! N7 P6 [( w    }
* X4 T6 Y6 q6 t5 g' S    if ($request_method = 'GET') {
4 @# G. U4 \' }) w% D        set $cors "${cors}get";
    }
+ s: I5 }+ y& o/ Q& Q1 }& O    if ($request_method = 'POST') {
( c: h4 r0 ]& I  O; `* r        set $cors "${cors}post";
  g7 H/ D) e" X1 Z    }

    if ($cors = "true") {
/ ?! Y8 ]  }" B        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
2 v/ t9 W) e( F# d1 }    }
/ n  Q7 K4 c+ q
    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
- I; U$ t" i: N  Y- d        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
* f9 `; I1 F2 Q( D$ Y        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
! }* f$ e! v" s0 _% L. O    }
  T9 U4 u5 [, x
9 g. k- z8 v; U$ c    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
        # Om nom nom cookies
        #
( y8 c% \+ e' O5 c        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
" i9 w, |8 S, _( ]2 e2 A
; \$ Y  ~8 l! k9 _        #
5 |# M, O) X) w8 h. |; ]        # Custom headers and headers various browsers *should* be OK with but aren't
: o  _+ E# N5 B. i        #
# b6 H. L! Z. S0 I; d        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
, S5 E- t* M- \% o3 u        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
% e9 j( k5 v; ?  @& j# R        add_header 'Content-Length' 0;
2 X3 x) ?& A# n. T        return 204;
    }

1 ~, {# L) |% R! F$ `! V9 o    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
  k& y( Z8 a! T% t' |' A! r8 _        add_header 'Access-Control-Allow-Credentials' 'true';
' X9 G7 L- J3 l0 {9 T6 T        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
" h; r; b5 M. d/ D( Q        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
8 [8 o! c8 `) V# m    }

}

3 w* W0 i( B6 W9 O