Nginx之CORS（Cross-Origin Resource Sharing，跨來源資源共享）來實現防止盜連多媒體資源

IT_man

以下是gist.github.com支援reverse proxied APIs的範例:

# CORS header support
#
7 U- t/ D. y/ h# One way to use this is by placing it into a file called "cors_support"
) t- T- [8 @, `: c# e# under your Nginx configuration directory and placing the following
9 V9 @9 w! B! p. q/ \/ `) J# statement inside your **location** block(s):
#
#   include cors_support;
# N. ?' M. a, ]6 @+ W. d#
# As of Nginx 1.7.5, add_header supports an "always" parameter which
. A1 w- T% H! T# allows CORS to work if the backend returns 4xx or 5xx status code.
/ x0 B- @0 w& [#
' ]6 B  L! a$ X! u# For more information on CORS, please see: http://enable-cors.org/
# Forked from this Gist: https://gist.github.com/michiel/1064640
: J! L. C$ ^( b- d#

, R  f4 c8 C  o% Hset $cors '';
9 M7 G6 U  w9 a' B6 B6 v8 s1 D3 oif ($http_origin ~ '^https?://(localhost|www\.yourdomain\.com|www\.yourotherdomain\.com)$') {
; ]) B! X  }$ G$ l4 w# U        set $cors 'true';
}

if ($cors = 'true') {
; z3 v- F1 Q/ ~, x. y; \- v        add_header 'Access-Control-Allow-Origin' "$http_origin" always;
: l8 U$ U+ b: D        add_header 'Access-Control-Allow-Credentials' 'true' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;
. u3 h* g, Q0 Y4 g9 y        # required to be able to read Authorization header in frontend
. I1 I/ [6 a, _  I        #add_header 'Access-Control-Expose-Headers' 'Authorization' always;
4 A7 |% f4 N( L+ c! E}

if ($request_method = 'OPTIONS') {
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000;
% D8 w1 r' B* q! S6 x+ I        add_header 'Content-Type' 'text/plain charset=UTF-8';
5 D1 n# E. k; C7 x6 ~        add_header 'Content-Length' 0;
        return 204;
6 m9 d# ^9 M" y, d3 f* A}

https://gist.github.com/Stanback/7145487#file-nginx-conf 的討論範例:

if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {     return 444;
1 G3 m- v2 k! ~1 K- }# A}
; g# t7 ]/ ^2 E9 X* `$ [0 w+ g) d% d( k5 Gset $origin $http_origin;
if ($origin !~ '^https?://(subdom1|subdom2)\.yourdom\.zone$') {
     set $origin 'https://default.yourdom.zone';
}
if ($request_method = 'OPTIONS') {
/ }% w' ^! W* P' A     add_header 'Access-Control-Allow-Origin' "$origin" always;
5 |+ l% k$ F$ _* v4 a- |5 x     add_header 'Access-Control-Allow-Methods' 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
* v$ P4 U! H1 @) [" f( ~8 D5 G) W     add_header 'Access-Control-Allow-Headers' 'Content-Type, Accept, Authorization' always;
     add_header 'Access-Control-Allow-Credentials' 'true' always;
4 E' @- W; ^" n' ~     add_header Access-Control-Max-Age 1728000;   #20 days   
     add_header Content-Type 'text/plain charset=UTF-8';
4 f# u% s9 w% p( W0 v8 h     add_header Content-Length 0;
- }% j  K( x$ w0 w$ G6 c     return 204;
}
1 A. F1 W* |" ~if ($request_method ~ '(GET|POST|PATCH|PUT|DELETE)') {
4 {5 p1 \$ J- u" D5 z3 r' p     add_header Access-Control-Allow-Origin "$origin" always;
     add_header Access-Control-Allow-Methods 'GET, POST, PATCH, PUT, DELETE, OPTIONS' always;
     add_header Access-Control-Allow-Headers 'Content-Type, Accept, Authorization' always;
     add_header Access-Control-Allow-Credentials true always;
}

Access-Control-Allow-Origin Multiple Origin Domains? 的例子:

# based on https://gist.github.com/4165271/
. a9 [7 Q) o, {#
! B9 Y. L; E# j9 X; W& Z$ {# Slightly tighter CORS config for nginx
) V% q3 K* o1 J2 ]#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
. t8 B3 O+ q9 @; v# To avoid the use of 'Access-Control-Allow-Origin: *', use a simple-ish whitelisting
# method to control access instead.
$ }$ z5 T9 A9 ?4 p3 b- K/ e- x: H#
# NB: This relies on the use of the 'Origin' HTTP Header.
2 c) V" \4 w* f
location / {
) U" Y/ k+ G3 e  I' G
, u3 ?: r1 W- r, i+ I+ I* |    if ($http_origin ~* (^https?://([^/]+\.)*(domainone|domaintwo)\.com$)) {
8 f# x/ y; q) d! g        set $cors "true";
6 e3 m' c  k$ o) I7 }    }

0 u- y* o0 @$ L/ u* r% y) a    # Nginx doesn't support nested If statements. This is where things get slightly nasty.
    # Determine the HTTP request method used
: Y8 C5 A6 r$ l7 A- i, o+ s$ ?    if ($request_method = 'OPTIONS') {
  h! r, w+ x1 x! w1 o        set $cors "${cors}options";
    }
6 @3 |5 _6 {, c8 ]7 S, N% k    if ($request_method = 'GET') {
  P% d6 S0 O/ Y) V2 c; Y        set $cors "${cors}get";
1 @3 A# y3 u5 V  [$ W+ D    }
5 P! O5 s3 N) E+ M2 P    if ($request_method = 'POST') {
2 C! i4 A& q0 {8 c/ h        set $cors "${cors}post";
    }

* U# [, \- {% b$ [6 ?6 j7 S    if ($cors = "true") {
        # Catch all incase there's a request method we're not dealing with properly
7 y5 N: \& }4 y. B        add_header 'Access-Control-Allow-Origin' "$http_origin";
* R" H/ E# u4 f+ g  _1 u+ R4 m' A    }

    if ($cors = "trueget") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
! b* Y- f- \+ b% g* Z        add_header 'Access-Control-Allow-Credentials' 'true';
# z  b. J4 }  W; B5 U1 U6 m        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
' K) |" N- Q' \: C$ A% k! I- i    }
5 j# k% g' i) G5 t$ `+ [3 a2 a: E
" g9 w, W$ d5 ^. O9 ?    if ($cors = "trueoptions") {
        add_header 'Access-Control-Allow-Origin' "$http_origin";
, `5 p& b% ^, v5 f5 |9 M$ m7 g
        #
! p. y! M- Q& a* V- m9 ^        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

2 q# ?4 S( @  T  {& ]. x' x# G' T& R        #
& I$ w* o) c# W9 H( V# l# B( F        # Custom headers and headers various browsers *should* be OK with but aren't
        #
% U8 c: Y3 e! g- k1 D, V6 p% K        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';

        #
        # Tell client that this pre-flight info is valid for 20 days
' P* O) {7 ^! `% `        #
* q4 B7 z% a) G$ g. X        add_header 'Access-Control-Max-Age' 1728000;
! g7 o* z* x, \/ R# O        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
    }
7 f3 Q  j# M. z# W0 E; L8 k' h) ?
  k2 ]  N$ |% |/ c* g! \    if ($cors = "truepost") {
5 t7 X# r& p9 q# d        add_header 'Access-Control-Allow-Origin' "$http_origin";
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
1 ]* a( |1 w- x# J/ q. [+ [/ a        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
# |4 R8 i, I5 m" v5 R1 M$ a
}

8 c( ^) a  Y4 q' h# x