Question

我想让我的nginx代理只在客户端尚未经过身份验证时才执行子请求进行身份验证。条件部分是我被困的地方。如何制作配置，以便每次会话只对客户端进行一次身份验证？

我能够成功地对Apache执行auth_request并将我想要传递的头部拉回到后端，但是每次请求都会发生这种情况并且价格昂贵。

在这里的示例中，我的目标是仅在＆＃34;授权＆＃34;之后执行auth_request。标头丢失或为空或者交替使用包含令牌的cookie

# DEFAULT BACKEND
    location / {

        proxy_pass_request_body off;

        if ($http_authorization ~* '')
        {
            rewrite ^(.*)$ /__login;
        }

        if ($user !~* "([aa-zZ]+)@example.com")
        {

        }

        if ($http_cookie !~* "(auth_cookie=([aa-zZ]+)@example.com)")
        {
            add_header Set-Cookie "auth_cookie=$user;domain=.example.com;Max-Age=3000";

        }

        proxy_pass_header x-webauth-user;
        proxy_pass_header Set-Cookie;
        proxy_pass http://example.com:6762/;

   }

location / __ login { 内部;

    auth_request /auth;
    auth_request_set $user $upstream_http_x_webauth_user;
    set $xuser $user;

    add_header Auth-User $user;
    proxy_set_header User-Name $user;
    proxy_set_header Authorization $http_authorization;

    #proxy_pass_header x-webauth-user;
    #proxy_pass_header Set-Cookie;

    proxy_pass http://example:6762/;

    access_log /etc/nginx/login_debug.log;
   }


location = /auth{
    internal;
    proxy_pass http://example.com:81/;

    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for;
    #proxy_pass_header  Set-Cookie;
    #proxy_pass_header  x-webauth-user;
}

Auth-User标头在第一个之后的所有请求中都会丢失，并且cookie似乎永远不会被设置，超出该页面实际上似乎无法在浏览器中呈现。我显然做了一些非常错误的事情，有些人可以帮我解决这个问题。

Answer 1

请检出NJS（https://nginx.org/en/docs/njs/）模块。这真的很简单，可以肯定可以做您想要的。这是示例解决方案：

文件：/etc/nginx/conf.d/default.conf：

server {
    listen 80;
    server_name "SOME_SERVER";
    # make an authentication subrequest for every request
    auth_request /auth;

    # create a new variable AuthToken and set its value to the res.SOMEVALUE from the later subrequest... 
    auth_request_set $AuthToken $sent_http_token;
    
    # add new AuthToken to the request
    proxy_set_header Authorization $AuthToken;

    location / {
        proxy_pass http://SOME_ENDPOINT;
    }

    location = /auth {
        internal;

        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;

        js_content auth.main;
    }

    location /get-new-token-location {
       internal;

       proxy_pass http://SOMEURL;
    }
}

和nginx.conf文件示例，以展示如何启用NJS模块：

...
pid /var/run/nginx.pid;

load_module /usr/lib/nginx/modules/ngx_http_js_module.so;

events {
    use epoll;
    worker_connections 10000;
}


http {
    # import njs scripts
    js_import auth from /path/to/the/auth.js;
    
    include /etc/nginx/conf.d/default.conf;
}

最后是auth.js文件的主要功能：

export default {main}

function main(r) {
    var token = "";
    // search token in Authorization header
    if (this.requestHeaderExists(r, 'Authorization')) {
        var m = r.headersIn.Authorization.match(/Bearer\s+(.+)/);

        if (m !== null && typeof m[1] !== 'undefined') {
            token = m[1];
        }
    }

    // search token in cookie
    if (token.length == 0) {
       ... code here ...
    }

    // token was found, you can somehow validate it if you want
    if (token.length > 0) {
       .., make sure token is valid...
    }
    else { // there is no token, so ask for the new one
       r.subrequest('/get-new-token-location, { method: 'GET' }, function(reply) {  
         var res = JSON.parse(reply.responseBody);
         // add token to the response headers of this sub-request
         r.headersOut['token'] = res.SOMEVALUE;
       }
    }
   r.return(200);
   return;
}

请以它为例。好的，也许看起来很复杂，但是它确实功能强大，可以肯定的是，您可以在万维网上找到更多示例。

条件nginx auth_request

1 个答案: