Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

# CORS header support
# Z' R* n- f9 L7 |7 i2 w; M#
' a! {5 x  E; ]# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
#
0 q. _2 |% g/ f. y1 c6 \#   include cors_support;
#
* ?- n6 q; s& S# As of Nginx 1.7.5, add_header supports an "always" parameter which
$ y( P! e4 M9 B# allows CORS to work if the backend returns 4xx or 5xx status code.
#
# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
/ H8 y1 f6 e' D) r6 M6 B#
" z+ |" y2 `2 J: B; ]
set $cors '';
if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
; [. g1 h# ^/ g' S5 c, u* P        set $cors 'true';
8 I/ l2 R, w6 e; I}

% ?# F0 N; _% _, X' O  Wif ($cors = 'true') {
        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
9 @" q1 a; r; T, T9 O7 z        add_header 'Access-Control-Allow-Credentials' 'true' always;
, d( J' R: W4 x: U8 m; C: j+ }. i        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
9 h3 F, [$ m' |$ l8 C' |0 l9 A        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}
3 Z# I* X. M) H" a1 D
: P* d0 r  p( zif ($request_method = 'OPTIONS') {
2 S* Y0 {- @# O# B% @        # Tell client that this pre-flight info is valid for 20 days
2 Y) e4 M. Z7 G0 a        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
1 Q. v/ d; g/ n0 [        add_header 'Content-Length' 0;
/ D6 {7 ?& e! c. I        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:
5 N& \# z) r' b. T' b& n* u

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
}
set $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
4 M$ e1 g) T5 g8 [  @8 A4 z) _; k}
if ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
+ m  E' x  z' G' m7 }     add_header 'Access-Control-Allow-Credentials' 'true' always;
9 I0 ?/ q" c4 J     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
5 L, l/ x# Q% D     add_header Content-Length 0;
5 S. q. W& j" {. W4 B' d2 J* Q     return 204;
  f  J$ g0 C# ^# q}
3 K: B; C6 v( K; W) Fif ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
) T3 W4 a% {5 d3 Y+ |  u2 i     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
2 ?! I9 s. ~) U     add_header Access-Control-Allow-Credentials true always;
" v: O' \3 O( y9 `9 v7 ]}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
- Y2 y' |* h: W& Y* N( y4 N# H#
# Slightly tighter CORS config for nginx
' l# F$ G; B1 W#
2 T6 u" j5 [' R! x# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
. G( Z' e) h; |! E( O* C: C# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
1 o- c$ E9 ^* F. @# don't seem to play nicely with this.
#
# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
3 E6 V$ E5 q# s# method to control access instead.
#
# NB: This relies on the use of the 'Origin' HTTP Header.
( m' q  p# D+ R8 M8 l, n3 w* X: I4 f
7 \9 E5 }) u/ Tlocation / {
1 H3 N) j" I2 m3 h8 X+ K; n6 x
    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
        set $cors "true";
2 A3 a9 F/ a: z9 @    }
( V; a6 E0 k4 s$ H* t
/ T" Z% \" F  R# z0 a9 ~    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
/ S+ D, I* C* M! r; n4 l, W; L        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
1 \0 v: m8 F8 M' C! S/ l0 X9 b    }
. u1 m# t, @% O* b9 Y' L8 w4 Y    if ($request_method = 'POST') {
. d9 q8 E8 [( J3 W8 I6 p' N3 v        set $cors "${cors}post";
# C) S- W# n$ H% \5 V) x/ L    }
4 ~6 }6 \' ^' ]- ]  C
3 V1 v. Y* _! t0 C$ v    if ($cors = "true") {
6 t" }: Q& X7 x& q- t- I        # Catch all incase there's a request method we're not dealing with properly
        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

    if ($cors = "trueget") {
( |2 Q7 r1 s. s/ o$ f        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
' n: f; w  j. {' q7 x* G3 \        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
9 K6 _8 O2 j/ c+ k        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }

$ k3 Q4 _9 B1 j) m    if ($cors = "trueoptions") {
3 D# v. b; h8 S" @: r' D        add_header 'Access-Control-Allow-Origin' "$http_origin";
4 I. L8 q0 m2 n3 m, C0 J2 h1 R7 r
        #
# u& X, [( f' q, `+ Z( M9 Z% y        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
2 o- W8 N9 {1 g, f; B7 x4 E        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
9 n$ ]& W6 _' y6 M8 m% @5 W
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
! v+ F3 b% y2 k9 Z        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
0 p) H9 z9 |, N9 A
- H& m1 B. A4 D9 a) A        #
" g7 Z! F& x6 k1 ?" {  @& b6 p! b7 X        # Tell client that this pre-flight info is valid for 20 days
        #
, W: c" v! V- d        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
# d$ N- o, E( G3 Z        return 204;
" P# q/ N" `! v0 A' t& x6 V    }

# T2 W  u4 B* k+ P5 @/ o    if ($cors = "truepost") {
5 m; L4 G9 l  T3 e" V        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
5 d; n* o1 M' D4 w0 J) F" M" E        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
- \9 i& q+ `& X: N# B    }

}