Nginx 可选的 auth_request

Question

我想让 nginx 拒绝具有无效凭据的客户端，同时仍然允许根本没有 Authorization header 的客户端。

当前配置:

server {
    listen 443 ssl;
    server_name ...;

    proxy_http_version 1.1;
    proxy_redirect off;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location / {
        proxy_pass http://localhost:8080;
    }
}

如果 auth_request 在 if 中工作，这将解决我的问题:

    location / {
        proxy_pass http://localhost:8080;
        if ($http_authorization) {
            auth_request /login;
        }
    }

Answer 1

这似乎可行:

    proxy_http_version 1.1;
    proxy_redirect off;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location /__auth {
        internal;
        proxy_pass http://localhost:8080/login;
    }

    location / {
        if ($http_authorization) {
            rewrite ^(.*)$ /_auth$1 last;
        }
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Logged-In "";
        proxy_pass http://localhost:8080;
    }

    location ~ /_auth(.*) {
        internal;
        set $gooduri $1;
        auth_request /__auth;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Logged-In 1;
        proxy_pass http://localhost:8080$gooduri;
    }

这个问题仍然需要更好的解决方案。