Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

# CORS header support
1 |$ _0 s& D  J/ r4 {* P! @#
* x) T8 E( z! j# One way to use this is by placing it into a file called "cors_support"
# under your Nginx configuration directory and placing the following
# statement inside your **location** block(s):
  Y4 x" Z' [1 W+ w* _& `7 Q#
% \# z+ d* `6 u! I8 o- X#   include cors_support;
$ ], c- Q( O- l: P# ?4 ~* {#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
# allows CORS to work if the backend returns 4xx or 5xx status code.
3 t7 `" N- B8 K* T  I* d#
, d) R: b/ A: Y8 t! G" F# For more information on CORS, please see: http://enable-cors.org/
% f/ H5 L4 S# p4 B4 i/ i( X. G# Forked from this Gist: https://gist.github.com/michiel/1064640
#
* ^8 g# M+ j6 K  c
8 K  A! F9 }" Q- M0 eset $cors '';
. i  b1 Y; x0 ?$ [1 c% }if ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
6 v3 E7 j* t5 C3 p! v: Q( q        set $cors 'true';
}
/ y: M: K5 ]9 n! p' R
1 l% g/ d; _$ G& T" O, |; {: nif ($cors = 'true') {
5 a- H, v1 l: K+ t. n) e        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
        # required to be able to read Authorization header in frontend
        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
}

if ($request_method = 'OPTIONS') {
+ d4 y) `3 Z& F* {9 m8 z        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
% J1 U* G" {; @* y: ?4 t# c1 n8 ?; I        add_header 'Content-Type' 'text/plain charset=UTF-8';
: r0 y! W9 Z: R/ ^0 W, G6 Q9 }        add_header 'Content-Length' 0;
        return 204;
}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
7 f/ L4 P  r* C: D* c( Y! L}
set $origin $http_origin;
& Q3 P$ E6 D8 c( cif ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
8 \4 I0 _* t6 u0 _% {1 z% L     set $origin 'https://default.yourdom.zone';
}
" n  X' O6 Q8 mif ($request_method = 'OPTIONS') {
     add_header 'Access-Control-Allow-Origin' "$origin" always;
     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
: t5 T  [' q; X     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
! G* k7 P3 P9 O/ T  `     add_header 'Access-Control-Allow-Credentials' 'true' always;
+ k% o, H% E1 y1 p* K  Z! \     add_header Access-Control-Max-Age 1728000;   #20 days   
" _! m, h1 J  K( T) r& M     add_header Content-Type 'text/plain charset=UTF-8';
     add_header Content-Length 0;
# N- x. [: r+ G: Z0 d- u     return 204;
2 M0 u6 X6 K! |/ W2 a( W}
if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
     add_header Access-Control-Allow-Origin "$origin" always;
8 C! X! K8 u4 p/ {5 c     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
. \6 N$ x! J' z4 i0 R, p/ J) ]}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
#
# Slightly tighter CORS config for nginx
+ s+ j9 L0 k" E: g' N#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
# H" t1 N( ^! U! X. a#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
- k+ C6 [' O0 a1 @7 P! F4 h# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
5 D; e, B/ v1 B#
# NB: This relies on the use of the 'Origin' HTTP Header.
8 A3 Q$ B& g# _2 Q
% j" r$ f* q$ Xlocation / {
7 G7 ~: Y3 z* \7 e5 n8 x' D" H. j
1 J+ z. U+ m" z( k" F0 q2 R" l    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
0 }5 t4 N" Z/ ]' ]& ^  O1 t8 J        set $cors "true";
    }

    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
3 Y# a5 |. ]' \: o; \1 e; S    # Determine the HTTP request method used
    if ($request_method = 'OPTIONS') {
# j; ]4 H8 ^% W) Z- [) O1 N3 |8 U        set $cors "${cors}options";
    }
    if ($request_method = 'GET') {
        set $cors "${cors}get";
  N5 ^* E5 K' B% Z9 V: I$ S    }
    if ($request_method = 'POST') {
        set $cors "${cors}post";
    }

9 O9 G, W6 z7 Z: i) {; d    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
9 Z6 F0 x! F" v- B        add_header 'Access-Control-Allow-Origin' "$http_origin";
    }

    if ($cors = "trueget") {
4 s3 c4 x( }. R        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
5 k- K) G: T+ N/ K! p        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
) k* @, e2 l& w        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
$ V) W! T8 W3 ^$ l1 r# s) e* D    }

- D& U; |2 N1 m# h5 v' j: K    if ($cors = "trueoptions") {
! r+ T+ r$ D* ^! Q4 a        add_header 'Access-Control-Allow-Origin' "$http_origin";

: x6 d5 ?% ?( p0 {' L        #
        # Om nom nom cookies
+ K3 @8 L( R0 Y; X        #
3 ]( y6 P, q- N% k/ X1 J0 ]        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
. P" a2 e, }6 M3 ?) K3 r0 b
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
1 _; J1 t# _2 }        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
7 W' f- P5 F8 `7 ^! l$ P3 o
        #
        # Tell client that this pre-flight info is valid for 20 days
* Q6 l& k# F3 t' q4 g( i        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
$ L/ f1 Z+ h& o* I  w        add_header 'Content-Length' 0;
5 W* r4 f* _( }8 D7 ?/ a        return 204;
    }
; Z3 ^& O& r* v, J
: C+ \: U9 N1 F# l& S$ I    if ($cors = "truepost") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
0 x# }4 f$ l% L6 ^        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
$ t, l/ N2 U1 H. [        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
: i3 A1 H6 {: o4 y+ l    }

: E0 C# P1 t2 r" @6 _7 b( f}