nginx - nginx如何检查请求头是否包含授权

Question

我读过这个post Nginx 不支持多个授权 header 。

我想知道如果存在授权 header 。

基本上我正在向我的网页添加基本身份验证，因为它尚未准备好投入生产。我的站点是单页应用程序，我已在索引页面中成功添加身份验证，但我的站点也具有登录功能。当我登录时，它不断要求再次进行身份验证。我是 nginx 的新手，我不太确定如何解决这个问题

 location / {

        root /path/to/my/app/root/folder;
        index index.html index.php;

        #I want to only executed these lines only on the index page and login page 
        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }

Answer 1

您可以使用 curl 查看 header :

$ curl -v -u your_user_name "http://......."

查找 > Authorization: Basic ... 行，其中包含 user:pass 的 Base64 编码。

您可以使用以下方法解码字符串:

printf auth_string | base64 --decode

更多详情 here .

---

此外，请确保 /etc/nginx/.htpasswd 具有正确的权限，以便 nginx 能够读取它，并且它包含您的用户/密码凭据nginx ( info here ) 识别的格式:

<强>1。纯文本:

    # comment
    name1:password1
    name2:password2:comment
    name3:password3

<强>2。加密/散列:

• encrypted with the crypt() function; can be generated using the “htpasswd” utility from the Apache HTTP Server distribution or the
  “openssl passwd” command;

• hashed with the Apache variant of the MD5-based password algorithm (apr1); can be generated with the same tools;

• specified by the “{scheme}data” syntax (1.0.3+) as described in RFC 2307; currently implemented schemes include PLAIN (anexample one, should not be used), SHA (1.3.13) (plain SHA-1hashing, should not be used) and SSHA (salted SHA-1 hashing, usedby some software packages, notably OpenLDAP and Dovecot).

$ htpasswd 
Usage:
    htpasswd [-cimBdpsDv] [-C cost] passwordfile username
    htpasswd -b[cmBdpsDv] [-C cost] passwordfile username password

    htpasswd -n[imBdps] [-C cost] username
    htpasswd -nb[mBdps] [-C cost] username password
 -c  Create a new file.
 -n  Don't update file; display results on stdout.
 -b  Use the password from the command line rather than prompting for it.
 -i  Read password from stdin without verification (for script usage).
 -m  Force MD5 encryption of the password (default).
 -B  Force bcrypt encryption of the password (very secure).
 -C  Set the computing time used for the bcrypt algorithm
     (higher is more secure but slower, default: 5, valid: 4 to 31).
 -d  Force CRYPT encryption of the password (8 chars max, insecure).
 -s  Force SHA encryption of the password (insecure).
 -p  Do not encrypt the password (plaintext, insecure).
 -D  Delete the specified user.
 -v  Verify password for the specified user.
On other systems than Windows and NetWare the '-p' flag will probably not work.
The SHA algorithm does not use a salt and is less secure than the MD5 algorithm.