Question

我正在尝试配置http_auth_request_module，但是我的身份验证请求网址无法正常工作，但是如果我通过“ return 200”而不是url代理通过，则可以使用，但在基于proxy_pass的情况下则无法使用。从URL获取状态代码需要传递什么过程和请求url模式。

server { server_name xx.xx6.1x5.1x5;


listen 80;

client_max_body_size 4G;

access_log /home/ubuntu/logs/nginx-access.log;
error_log /home/ubuntu/logs/nginx-error.log;

location / {
    auth_request /auth;
    error_page 401 = @error401;

    auth_request_set $user $upstream_http_x_forwarded_user;
    proxy_set_header X-Forwarded-User $user;
    proxy_pass http://1x.2xx.22x.1x4:9200;
}

location @error401 {
    return 302 https://gmail.com;
}

location /auth {
    internal;
    #return 200; ##it's working
    proxy_pass https://google.com; ##it's not working giving error 500
    proxy_pass_request_body  off;

    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

}

Answer 1

这是我的服务器上的工作方式。 nginX的配置是

    location ~ ^/attached {
        auth_request /auth-here;
    }
    location /auth-here {
        proxy_pass http://example.com/auth.php;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
    }
    location / {
        try_files $uri $uri/ @rewrites;
    }
    location @rewrites {
        rewrite ^/apple /favicon.ico break;
        rewrite ^ /index.php last;
    }

然后auth.php

的内容

session_start();
// check whether the user is logged in - using whatever mechanism your application is using
if(!$logged_in)
{
    $u = trim($_SERVER['PHP_AUTH_USER']);
    $p = trim($_SERVER['PHP_AUTH_PW']);
    // if no Authorization provided - ask for one
    if($u=='' OR $p=='')
    {
        header('WWW-Authenticate: Basic realm="Your session timed out - login again"');
        header('HTTP/1.0 401 Unauthorized');
        echo 'Bad login - wrong username or password';
        die;
    }
    else
    {
        // try to login using the provided credentials
        if(tryLogin($u,$p))
        {
            // we are now logged in
        }
        else
        {
            // could not login - ask authorization again
            header('WWW-Authenticate: Basic realm="Your session timed out - login again"');
            header('HTTP/1.0 401 Unauthorized');
            echo 'Bad login - wrong username or password';
            die;
        }
    }
}

基本上，如果用户已登录，我们什么也不做。如果他/她没有登录-我们要求提供凭据（或者您可以简单地返回403）

Answer 2

如果子请求身份验证成功，请检查子请求身份验证，它将给出200，并且父请求将通过

Nginx的auth htp请求模块无法正常工作，给出500错误

2 个答案: