Question

我目前已经花了几天时间尝试解决此问题。按照目前的现状，每当我通过Chrome登录生产环境中的Rails 5应用程序时，都会出现此错误。我正在运行rails version 5.1.5，ruby 2.3.1和nginx/1.10.3。我的应用程序在ELB（弹性负载平衡器）后面的EC2实例上运行，其转发规则为端口80上的http到端口443上的https。我很清楚，此问题源于我的请求标头指示起点与目的地不同。我也知道，可以通过更新我的nginx.conf文件或禁用Rails的CSRF保护（根据我的理解，这对我来说就安全性而言不是一个可行的解决方案）可以纠正此问题。我试图通过通过before_action在application_controller中手动设置标头来解决此问题，但这没有用。我还尝试使用在SO和其他地方找到的示例更新nginx.conf文件，但这只会导致502网关错误。问题是我发现示例的语法不兼容，或者只是犯了所有可能的笔误，我合法地在一次重新添加一行的情况下重新引导了服务器并重新部署，但仍然没有运气。理想情况下，如果我设置标头的尝试完全不起作用，我想解决这一问题：

application_controller.rb

protect_from_forgery with: :exception, prepend: true
before_action :set_https_header

def set_https_header
  response.set_header('X-Frame-Options', 'SAMEORIGIN')
end

如果我必须更新ngnix.conf，请有人提供有关该语法的押韵或推理。

production.rb

config.cache_classes = true
  config.eager_load = true
  config.consider_all_requests_local       = false
  config.action_controller.perform_caching = true

  config.read_encrypted_secrets = true
  config.public_file_server.enabled = ENV['RAILS_SERVE_STATIC_FILES'].present?
  config.assets.js_compressor = Uglifier.new(harmony: true)

  config.assets.compile = false
  config/initializers/assets.rb

  # config.force_ssl = true
  config.log_level = :debug
  config.log_tags = [ :request_id ]

  config.action_mailer.perform_caching = false
  config.i18n.fallbacks = true
  config.active_support.deprecation = :notify

nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;
        gzip_disable "msie6";

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # Virtual Host Configs
        ##

                include /etc/nginx/conf.d/*.conf;
                include /etc/nginx/sites-enabled/*;
        }


        #mail {
        #       # See sample authentication script at:
        #       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
        # 
        #       # auth_http localhost/auth.php;
        #       # pop3_capabilities "TOP" "USER";
        #       # imap_capabilities "IMAP4rev1" "UIDPLUS";
        # 
        #       server {
        #               listen     localhost:110;
        #               protocol   pop3;
        #               proxy      on;
        #       }
        # 
        #       server {
        #               listen     localhost:143;
        #               protocol   imap;
        #               proxy      on;
        #       }
        #}

Answer 1

您需要将标题添加到nginx配置（存在另一个具有服务器配置的文件，而不是nginx.conf），这是一个示例：

server {
  listen 80;
  server_name server.com www.server.com;
  # some configuration here

  location @server {
            # ... some configuration here
            # this set proper header
            proxy_set_header Host www.my_actual_domain_name.com; 
            # ... some configuration here
    }

}

Source

HTTP Origin标头与request.base_url

1 个答案: