Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:
2 W* l6 a! V8 h! S" f( \0 ^4 R
9 u: v7 r9 [% k, K
6 C4 b5 x- P. r6 m0 W+ v% f

# CORS header support
#
5 V5 Y6 H7 |# m2 F+ S" v5 s, ]# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
' M" V. j* V/ w$ x8 h1 V  L8 s' V/ M# statement inside your **location** block(s):
4 R# ?. ]- D- P% D1 n  e#
#   include cors_support;
#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
% S) I! e) P' @- z; U$ C# allows CORS to work if the backend returns 4xx or 5xx status code.
#
0 K: O( Z' c1 i# O# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
#
; C4 l3 h* G! J9 w0 b; b4 |/ r" u
1 H& F( P/ b- K0 l) Bset $cors '';
& C% x- ~7 b7 J# r/ C! Qif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
+ s7 z4 A( A. Q% J* J0 {        set $cors 'true';
) d( a; _' U8 V+ A5 m  l3 f) N$ S}
0 D, N4 l2 p3 s% z, ?5 A3 ?8 m
9 D% g0 x: \5 N# {1 D5 Z% iif ($cors = 'true') {
# B) V, a/ Z' S! H6 |7 A# r+ L        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
- F: [) _9 z" o/ @3 I" y9 f        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
4 N7 z3 i+ U& l3 ^/ b* J: ]        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
; q* f" ?- _  J. N3 Y2 ?        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
" l3 K4 m* f! A' X) \3 U) p3 y! s}

if ($request_method = 'OPTIONS') {
/ S2 ]6 T6 L" E        # Tell client that this pre-flight info is valid for 20 days
. K/ o0 B8 a1 K4 ^5 M9 q/ Y        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
( |7 v, d; _+ d$ g! s        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
+ p7 P2 y4 f4 [/ `$ S$ ^

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
( q3 Y7 c* e+ T1 X: x}
if ($request_method = 'OPTIONS') {
6 ~7 g3 |6 \; \- @     add_header 'Access-Control-Allow-Origin' "$origin" always;
" ~( n/ T3 a8 k% W) c& b4 J     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
$ `- d! L9 m: G7 B) t* y/ A' J     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
     return 204;
' Q! A0 P. @+ n. [* z2 v% P}
+ ^# ]# ?4 _% l! X8 C: Bif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
6 u  ]8 p* _& v1 r# E$ T     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
# }3 w. G7 T& `6 S0 D#
# Slightly tighter CORS config for nginx
8 t% v; E6 v) S' ~4 D#
, W: \2 d% c# C# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
. {- j2 l2 J$ x' X  n#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
0 v- a" N* P" F  r3 D) w# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
% I8 ]- s; f5 K#
" k) T# D) n8 Q8 s9 s# NB: This relies on the use of the 'Origin' HTTP Header.

' w) s$ q, B) vlocation / {

    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
/ M1 v4 o; f; w8 J. }/ r        set $cors "true";
9 O( D  j0 F: W- i# M0 D! p    }

1 {! V" ]8 _$ P' b  L    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
6 G/ D( }+ \6 O4 U6 v+ e    # Determine the HTTP request method used
: q, s$ Y7 Y% O$ q3 m6 j7 M    if ($request_method = 'OPTIONS') {
        set $cors "${cors}options";
    }
; B6 B9 ~! r0 H6 ^  S% A. L    if ($request_method = 'GET') {
7 s# v7 Z- ?; O0 f* |6 C        set $cors "${cors}get";
    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }
( I, L. y+ @; r% E; s" ~( }
    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

& j8 W7 b' d- v) q6 A, R    if ($cors = "trueget") {
; Y2 O+ r( i1 y* S. t3 H- k: Z        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
  r' q4 @9 a: @" b$ z        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

2 T* _* v  L( }' E1 }. I2 D; ?    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";

        #
        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
2 A, w8 x' A& v9 d: K' m
2 a! L1 z* S$ [0 _  I* V+ [2 N2 ?7 o        #
) k) V( B) P& `* R, r+ J( e7 G        # Custom headers and headers various browsers *should* be OK with but aren't
. G" \) s$ B: @) K. X. j% G        #
& l6 w4 s* o4 |8 Y1 Q, k. c( P        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
* A% p" S3 |: V7 X6 `, T
+ x& R) b) Y. ?8 g  M4 s. `        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
# p* q% N" W( k        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
# d9 k; t4 w9 C- v8 _: [    }
9 U+ r1 w/ L% z8 ]- e+ {
- p1 S+ x: j  F, R4 D& y$ ^: j8 D- p3 t    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
" l! |0 q5 R# v$ x8 e- @' j+ A        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
+ c& b0 e- R  d$ K
7 Y1 D; r: N  G9 R+ o}

2 B7 N2 [' S$ y) P/ V; a( F