nginx之配置proxy_set_header问题梳理
客户端请求web服务,客户端:
ip:192.168.223.1
nginx作为反向代理服务器:
192.168.223.136 nginx作为后端web服务器:
192.168.223.137
前提条件:
配置nginx转发到后端服务器。
server {
listen ;
server_name 192.168.223.136;
location / {
root "/www/html";
index index.html;
#auth_basic "required auth";
#auth_basic_user_file "/usr/local/nginx/users/.htpasswd";
error_page /.html;
}
location /images/ {
root "/www";
rewrite ^/images/bbs/(.*\.jpeg)$ /images/$ break;
rewrite ^/images/www/(.*)$ http://192.168.223.136/$1 redirect;
}
location /basic_status {
stub_status;
}
location ^~/proxy_path/ {
root "/www/html";
index index.html;
proxy_pass http://192.168.223.137/;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
#proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
} location ^~/proxy_path/ {
root "/www/html";
index index.html;
proxy_pass http://192.168.223.137/;
将左侧匹配到的/proxy_path/开头的url全部转发到后端服务器 192.168.223.137。
现在一一测试各个proxy_set_header设置的变量的内容:
1、proxy_set_header Host $host;
将136代理服务器,137后端服务器的log_format修改为如下:
然后开启137后端nginx,查看日志:
192.168.223.136 "192.168.223.1" - - [17/Jul/2017:17:06:44 +0800] "GET /index.html HTTP/1.0" "192.168.223.136" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" "192.168.223.1"
即验证了proxy_set_header Host $host; $host就是nginx代理服务器,也就是客户端请求的host。
2、proxy_set_header Host $proxy_host;
将设置修改为上述 proxy_host 然后重启ngxin代理服务器136
[root@wadeson nginx]# sbin/nginx -s reload
重新请求代理页面:http://192.168.223.136:8080/proxy_path/index.html,然后日志如下:
首先查看136代理服务器的日志:
192.168.223.1 - - [18/Jul/2017:10:30:12 +0800] "GET /proxy_path/index.html HTTP/1.1" 192.168.223.136:8080 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "-"
因为win10是136的客户端,请求的host为192.168.223.136:8080,而nginx代理服务器作为137后端服务器的客户端,将请求的报文首部重新封装,将proxy_host封装为请求的host
那么137上面日志请求的host就是其自身,proxy_host就是代理服务器请求的host也就是后端服务器137
192.168.223.136 "192.168.223.1" - - [18/Jul/2017:10:30:12 +0800] "GET /index.html HTTP/1.0" "192.168.223.137" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "192.168.223.1"
3、proxy_set_header Host $host:$proxy_port;
了解了上面的知识,那么此处对应的host就知道代表的啥了,$host代表转发服务器,$proxy_port代表136转发服务器请求后端服务器的端口,也就是80
于是观察136、137的日志进行验证:
192.168.223.1 - - [18/Jul/2017:10:38:38 +0800] "GET /proxy_path/index.html HTTP/1.1" 192.168.223.136:8080 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "-"
192.168.223.136 "192.168.223.1" - - [18/Jul/2017:10:38:38 +0800] "GET /index.html HTTP/1.0" "192.168.223.136:80" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "192.168.223.1"
4、proxy_set_header X-Real-IP $remote_addr;
将$remote_addr的值放进变量X-Real-IP中,此变量名可变,$remote_addr的值为客户端的ip
nginx转发136服务器日志格式为:
log_format main '$remote_addr - $remote_user [$time_local] "$request" $http_host '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
nginx后端137服务器的日志格式:
log_format main '$remote_addr "$http_x_real_ip" - $remote_user [$time_local] "$request" "$http_host" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
两者区别在于"$http_x_real_ip",添加了这个变量的值
重新请求需要访问的地址http://192.168.223.136:8080/proxy_path/index.html
136的日志:
192.168.223.1 - - [18/Jul/2017:10:45:07 +0800] "GET /proxy_path/index.html HTTP/1.1" 192.168.223.136:8080 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "-"
137的日志:
192.168.223.136 "192.168.223.1" - - [18/Jul/2017:10:45:07 +0800] "GET /index.html HTTP/1.0" "192.168.223.136:80" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "192.168.223.1"
红色标记的就是"$http_x_real_ip"的值,即可以看见用户真实的ip,也就是客户端的真实ip。
5、proxy_set_header X-Forwarded-For $remote_addr;
理解了上面的含义那么这个封装报文的意思也就请求了
首先还是比对136和137的日志格式:
136代理服务器的日志格式:
log_format main '$remote_addr - $remote_user [$time_local] "$request" $http_host '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
137后端服务器的日志格式:
log_format main '$remote_addr "$http_x_real_ip" - $remote_user [$time_local] "$request" "$http_host" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
重新请求需要访问的地址http://192.168.223.136:8080/proxy_path/index.html
136的日志显示:
192.168.223.1 - - [18/Jul/2017:10:51:25 +0800] "GET /proxy_path/index.html HTTP/1.1" 192.168.223.136:8080 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "-",最后一个字段"$http_x_forwarded_for"对应的为空值
137的日志显示:
192.168.223.136 "192.168.223.1" - - [18/Jul/2017:10:51:25 +0800] "GET /index.html HTTP/1.0" "192.168.223.136:80" 304 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36" "192.168.223.1"
可以看出137后端服务器成功的显示了真实客户端的ip。
6、proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
5、6两者的区别:
在只有一个代理服务器的转发的情况下,两者的效果貌似差不多,都可以真实的显示出客户端原始ip
但是区别在于:
最新文章
- 征途 bzoj 4518
- java中 try return finally return
- BZOJ 2462: [BeiJing2011]矩阵模板
- 获取浏览器信息 c#
- 20145320《Java程序设计》第一次实验报告
- DX11.2 Tiled Resource Pool
- 神经网络的学习 Neural Networks learing
- C++要点
- POJ3050 Hopscotch 【DFS】
- sublime主题安装
- WPF MVVM模式的一些理解
- 使用kibana可视化报表实时监控你的应用程序,从日志中找出问题,解决问题
- android ----- 分享的连接在手机上打开App
- spring切换多数据源
- 289. Game of Life数组生存游戏
- stringify在苹果电脑下的值不能为空
- 菜鸟调错(四)——Spring与DWR集成,配置文件报错
- PHP7 - 如何禁用Xdebug
- BZOJ 2342: [Shoi2011]双倍回文 马拉车算法/并查集
- 20162327WJH 实验三 《敏捷开发与XP实践》 实验报告
热门文章
- __stdcall、Q_DECL_IMPORT、Q_DECL_EXPORT
- 【原创】go语言学习(二十)并发编程
- 函数第二部分:为什么说动态参数是没有计划好的参数-Python基础前传(11)
- vue文件中提示Expected Boolean, got String
- zabbix (一) 初识
- TopCoder SRM 582 Div 1 - Problem 1000 SemiPerfectPower
- Android中View大小的确定过程
- NetCore与 NET Framework 不同的地方
- JAVA基础知识|继承的几个问题
- OAuth 2.0 的四种方式