大家好,我对dotnet核心应用程序的反向代理配置有疑问。我的问题是,当我使用Identityserver Discovery端点时,URL末尾缺少端口号。
我有一个要求不正确的文件 https://:8421 / .well-known / openid-configuration 响应如下,这里的问题是身份验证服务的客户端使用该文档作为验证的基础,使用响应中的jwks_uri属性,该属性中列出的url缺少端口号,因此客户端无法调用openId配置。
{
"issuer": "https://<servername>",
"jwks_uri": "https://<servername>/.well-known/openid-configuration/jwks",
"authorization_endpoint": "https://<servername>/connect/authorize",
"token_endpoint": "https://<servername>/connect/token",
"userinfo_endpoint": "https://<servername>/connect/userinfo",
"end_session_endpoint": "https://<servername>/connect/endsession",
"check_session_iframe": "https://<servername>/connect/checksession",
"revocation_endpoint": "https://<servername>/connect/revocation",
"introspection_endpoint": "https://<servername>/connect/introspect",
"device_authorization_endpoint": "https://<servername>/connect/deviceauthorization"
}
端点配置的预期结果:
{
"jwks_uri": "https://<servername>:<port>/.well-known/openid-configuration/jwks",
}
在我的dotnet应用中,我设置了反向代理设置
services.Configure<ForwardedHeadersOptions>(options =>
{
options.ForwardedHeaders =
ForwardedHeaders.XForwardedFor |
ForwardedHeaders.XForwardedHost |
ForwardedHeaders.XForwardedProto;
options.ForwardLimit = 2; //Limit number of proxy hops trusted
options.KnownNetworks.Clear();
options.KnownProxies.Clear();
});
app.UseForwardedHeaders();
nginx配置如下
server {
listen <ip>:8421 ssl;
server_name _;
ssl_certificate <certPath> ;
ssl_certificate_key <certPath>;
location / {
proxy_pass http://127.0.0.1:8421;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Host $remote_addr;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Port 8421;
}
}
在更新到Identityserver 4 4.0之前,它具有Public origin属性,但在4.0中已弃用。现在改为使用dotnet baseurl。
在http管道中,我还记录了请求中的所有标头,并得到了以下结果:
2020-07-03 11:40:15.109 +00:00;[INF];Cache-Control--no-cache Connection--upgrade Accept--*/* Accept-Encoding--gzip, deflate, br Host--<hostName> User-Agent--PostmanRuntime/7.26.1 X-Real-IP--<ip> X-Original-Proto--http X-Forwarded-Host--<domainName with port> X-Forwarded-Port--8421 Postman-Token--44dc6573-71eb-4b36-8b2a-9768d71e5b64 X-Original-For--<ip address> ;;
答案 0 :(得分:0)
如果主机正在侦听非默认端口(对于 http 不是 80,对于 https 不是 443),请使用 $http_host 而不是 $host 来设置 < em>Host 如下图。
改变
change proxy_set_header Host $host;
到
proxy_set_header Host $http_host;
答案 1 :(得分:-1)
我还必须将端口添加到nginx配置中。将X-Forwarded-Host设置为$ host还不够,还必须添加 $ proxy_port
代理的工作配置
proxy_set_header X-Forwarded-Host $host:$proxy_port;