nginx指定多域名跨域

 nginx 配置多域名或者单域名允许跨域访问接口，实际中https只能访问https 的http访问http的不能交叉访问

 

1. 单个域名跨域：

server {
    listen xxx;
    server_name forasp.cn;

    location / {
        add_header 'Access-Control-Allow-Origin' 'http://192.168.5.191:9527';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE';
        add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept, Authorization, Userid, Timestamp, X-Request-ID';

        if ($request_method = 'OPTIONS') {
            add_header 'Access-Control-Allow-Origin' 'http://192.168.5.191:9527';
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE';
            add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept, Authorization, Userid, Timestamp, X-Request-ID';
            add_header 'Access-Control-Max-Age' 3600;
            return 204;
        }
    }
}

2. 多个域名跨域

# ============================================================
# 方案一：使用 map 定义允许的跨域来源（推荐，支持多域名 + 凭证）
# ============================================================
map $http_origin $cors_origin {
    default                     "";
    "http://192.168.5.191:9527" "http://192.168.5.191:9527";
    "http://www.forasp.cn"    "http://test.forasp.cn";
}

server {
    listen xxx;
    server_name forasp.cn;

    location / {
        add_header 'Access-Control-Allow-Origin'      $cors_origin;
        add_header 'Access-Control-Allow-Methods'     'GET, POST, OPTIONS, PUT, DELETE';
        add_header 'Access-Control-Allow-Headers'     'Origin, Content-Type, Accept, Authorization, Userid, Timestamp, X-Request-ID';
        add_header 'Access-Control-Allow-Credentials' 'true';

        if ($request_method = 'OPTIONS') {
            add_header 'Access-Control-Allow-Origin'      $cors_origin;
            add_header 'Access-Control-Allow-Methods'     'GET, POST, OPTIONS, PUT, DELETE';
            add_header 'Access-Control-Allow-Headers'     'Origin, Content-Type, Accept, Authorization, Userid, Timestamp, X-Request-ID';
            add_header 'Access-Control-Allow-Credentials' 'true';
            add_header 'Access-Control-Max-Age'           3600;
            return 204;
        }
    }
}

# ============================================================
# 方案二：允许任意域名跨域（⚠️ 不支持 Credentials）
# 注意：Access-Control-Allow-Origin: * 与 Credentials: true 互斥
#       浏览器会直接拒绝携带凭证的通配符响应
# ============================================================
server {
    listen 80;
    server_name forasp.cn;

    location / {
        add_header 'Access-Control-Allow-Origin'  '*';
        # ⚠️ 以下行已移除：* 模式下不能设置 Credentials
        # add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept';

        if ($request_method = 'OPTIONS') {
            add_header 'Access-Control-Allow-Origin'  '*';
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE';
            add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept, Authorization, Userid, Timestamp, X-Request-ID';
            add_header 'Access-Control-Max-Age'       3600;
            add_header 'Content-Length'               0;
            return 204;
        }
    }
}

以上就是nginx 跨域配置