Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
# K6 N# \& Y9 v0 \6 ?
* E( v0 A$ F* g" r
. f1 d+ h1 U- H/ t/ h1 z# _' z

# CORS header support
: y8 P8 ], P7 l$ Q3 ^9 l#
( H% O3 P5 D1 N( [6 N# One way to use this is by placing it into a file called "cors_support"
- F( K7 H6 p2 d- \; D3 `9 Z# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
6 ~$ j) J* [/ f# R#
#   include cors_support;
/ N0 K9 R% q# q8 ]' E$ A8 {# o#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
#
9 P/ F2 G+ W4 _- }" K6 _+ R5 @, e# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
+ g) x: Y6 F9 g3 a1 }
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
        set $cors 'true';
1 W) V2 l6 M) M- R8 [8 l) ]}
3 s4 k1 n8 R7 T/ ~, X; z. v3 s( Z
if ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
; E3 s  m7 o% E) g9 c* F6 {8 S- g# K" i        add_header 'Access-Control-Allow-Credentials' 'true' always;
8 J* _9 L2 e/ T$ z5 [3 d        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
2 e9 Z7 p5 {- c% u) B* t( [        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
+ c( N9 b7 @/ W6 e  K5 Q/ M
& g! v# W) D: i$ r% {if ($request_method = 'OPTIONS') {
6 `, p7 P, Q7 }+ h+ h2 Z9 q        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
: ]! y/ y! }0 R. ]

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
( U9 h/ H5 ~2 f5 mset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
; F" A) u1 T3 U/ X" X     set $origin 'https://default.yourdom.zone';
6 T' S7 i# ^6 m* {' I$ Z: }/ W}
if ($request_method = 'OPTIONS') {
" ?9 c9 f/ |0 l0 E& }     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
4 v) `: Y; o4 r     add_header 'Access-Control-Allow-Credentials' 'true' always;
     add_header Access-Control-Max-Age 1728000;   #20 days   
6 L& \# z& B; P0 w     add_header Content-Type 'text/plain charset=UTF-8';
% K1 U9 n& }  q% ^     add_header Content-Length 0;
     return 204;
}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
2 m. s: @6 H* E3 D4 \: t9 W     add_header Access-Control-Allow-Credentials true always;
) f9 t( h8 @5 w$ M" N}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
. S$ J8 T4 x  a& g0 x9 y3 {# Slightly tighter CORS config for nginx
. K, ^  J2 y, W7 E3 `$ T) }5 W#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
7 b; J$ j1 r* X7 k# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
( h* D9 n  l' }# method to control access instead.
#
' l3 N7 K# z" b; ~. u9 g7 L. R, k/ l7 @# NB: This relies on the use of the 'Origin' HTTP Header.

  X- X$ O$ }. T4 q8 ]1 C- t3 Plocation / {

- Q% S, i/ V* U& B    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
, }( w5 q9 o. v' F* i; J    }

' c! S- ?# l4 E8 w" F5 v, R7 n    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
' W4 L2 i/ k# A; ^8 _: {        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
9 G/ a& T( f* x7 j4 H0 w7 ?  }8 I- o0 h        set $cors "${cors}get";
: X0 H* ]4 n! P, t1 Z    }
( f/ ?7 L; _) O    if ($request_method = 'POST') {
) n# l1 T- v! X" m; c        set $cors "${cors}post";
& |8 ^- m: }; {0 ~! r  g% J    }

& w$ C& K2 W: R' b% I" T8 M1 ?    if ($cors = "true") {
( V( m; R, P4 V; O8 n4 U- g( h% F$ D        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
0 v8 c+ ^" k- ?# ^7 h        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
$ k5 h* l3 C0 d0 t$ A) z# J" i8 @    }

8 j: C( r4 w( f7 W* G7 {    if ($cors = "trueoptions") {
0 f3 P+ G5 W/ j/ X; e        add_header 'Access-Control-Allow-Origin' "$http_origin";
7 C, w3 m" G  p* F2 d% l$ ]3 u% F
$ ~$ a, x8 f5 t' C, l        #
        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
5 |1 |% F# O3 C; A        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
% _/ l- p, w- z3 X% v/ j
        #
* m" E8 b( c/ i; B* F/ Z0 H        # Custom headers and headers various browsers *should* be OK with but aren't
        #
, G7 K( a3 O  d0 ]& }- d        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

' c% H# j6 e. [5 K        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
/ a5 G& n0 l( [+ U        return 204;
    }
/ K! I9 O& ?% E, o/ i
) K6 |1 i) V! n0 [; g# g0 U    if ($cors = "truepost") {
- }/ e2 I% D3 L+ I( N- k7 {        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
# H) `, k6 e% \" L* M2 s        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
+ {1 B! b- q8 V  i
}