為 AWS 中託管的網站設置 HTTPS，但指向局域網中的 webAPI (Setting up HTTPS for a website hosted in AWS, but points to a webAPI in the local area network)

問題描述

為 AWS 中託管的網站設置 HTTPS，但指向局域網中的 webAPI (Setting up HTTPS for a website hosted in AWS, but points to a webAPI in the local area network)

我正在開展一個項目，我們在 AWS 上託管一個網頁。該網頁從局域網計算機名稱IE：Server‑24.Local調用webAPI。這種方法可確保數據不會離開網絡，因為 Server‑24.Local 不會暴露給 Internet。到目前為止，這種方法效果很好。但是，當我通過 certbot 啟用 HTTPS 時遇到問題：

如果我嘗試將 proxy_pass nginx 傳遞到本地主機上 AWS 中託管的 webapi，HTTPS 可以正常工作。但是，如果我 proxy_pass nginx 到 Server‑24.Local，它會返回跨域錯誤。兩個 webAPI 都支持 CORS。

有人有什麼建議嗎？

參考解法

方法 1:

you can research about Nginx CORS enabled in internet... It's about end user browser security in chrome etc...

Here is an example, put it inside location tag {}

#
# Wide‑open CORS config for nginx
#
location / {
     if ($request_method = 'OPTIONS') {
        add_header 'Access‑Control‑Allow‑Origin' '*';
        add_header 'Access‑Control‑Allow‑Methods' 'GET, POST, OPTIONS';
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access‑Control‑Allow‑Headers' 'DNT,User‑Agent,X‑Requested‑With,If‑Modified‑Since,Cache‑Control,Content‑Type,Range';
        #
        # Tell client that this pre‑flight info is valid for 20 days
        #
        add_header 'Access‑Control‑Max‑Age' 1728000;
        add_header 'Content‑Type' 'text/plain; charset=utf‑8';
        add_header 'Content‑Length' 0;
        return 204;
     }
     if ($request_method = 'POST') {
        add_header 'Access‑Control‑Allow‑Origin' '*';
        add_header 'Access‑Control‑Allow‑Methods' 'GET, POST, OPTIONS';
        add_header 'Access‑Control‑Allow‑Headers' 'DNT,User‑Agent,X‑Requested‑With,If‑Modified‑Since,Cache‑Control,Content‑Type,Range';
        add_header 'Access‑Control‑Expose‑Headers' 'Content‑Length,Content‑Range';
     }
     if ($request_method = 'GET') {
        add_header 'Access‑Control‑Allow‑Origin' '*';
        add_header 'Access‑Control‑Allow‑Methods' 'GET, POST, OPTIONS';
        add_header 'Access‑Control‑Allow‑Headers' 'DNT,User‑Agent,X‑Requested‑With,If‑Modified‑Since,Cache‑Control,Content‑Type,Range';
        add_header 'Access‑Control‑Expose‑Headers' 'Content‑Length,Content‑Range';
     }
}

you can help look at here [https://enable‑cors.org/server_nginx.html] ...

hopefully this help you...

(by MrSean、gumelaragum)

參考文件

1. Setting up HTTPS for a website hosted in AWS, but points to a webAPI in the local area network (CC BY‑SA 2.5/3.0/4.0)