nginx之配置proxy_set_header问题梳理

忘是亡心i 2023-10-02 20:12 1阅读 0赞

客户端请求web服务，客户端：
    ip：192.168.223.1
    nginx作为反向代理服务器：
    192.168.223.136
    
    nginx作为后端web服务器：
    192.168.223.137

前提条件：

配置nginx转发到后端服务器。

server {
    listen 8080;
    server_name 192.168.223.136;
    location / {
    root "/www/html";
    index index.html;
    #auth_basic "required auth";
    #auth_basic_user_file "/usr/local/nginx/users/.htpasswd";
    error_page 404 /404.html;
    }
    location /images/ {
    root "/www";
    rewrite ^/images/bbs/(.*.jpeg)$ /images/$1 break;
    rewrite ^/images/www/(.*)$ http://192.168.223.136/$1 redirect;
    }
    location /basic_status {
    stub_status;
    }
    location ^~/proxy_path/ {
    root "/www/html";
    index index.html;
    proxy_pass http://192.168.223.137/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    #proxy_set_header X-Forwarded-For $remote_addr;
    
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
    }
    
    location ^~/proxy_path/ {
    root "/www/html";
    index index.html;
    proxy_pass http://192.168.223.137/;

将左侧匹配到的/proxy\_path/开头的url全部转发到后端服务器 192.168.223.137。

现在一一测试各个proxy\_set\_header设置的变量的内容：

**1、proxy\_set\_header Host $host;**

将136代理服务器，137后端服务器的log\_format修改为如下：

log\_format main '$remote\_addr -  r e m o t e u s e r \[ remote\_user \[ remoteuser\[time\_local\] " r e q u e s t " ∗ ∗ request" \*\* request"∗∗http\_host\*\* ’

'$status  b o d y b y t e s s e n t " body\_bytes\_sent " bodybytessent"http\_referer" ’

‘“ h t t p u s e r a g e n t " " http\_user\_agent" " httpuseragent""http\_x\_forwarded\_for”’;

proxy\_set\_header Host $host;

这里的Host变量的值对应的就是日志中的 **$http\_host** 的值

当客户端用户访问 [http://192.168.223.136:8080/proxy\_path/index.html][http_192.168.223.136_8080_proxy_path_index.html] 时

查看代理服务器和后端服务器的地址，可以发现 **$http\_host** 对应的值为： 192.168.223.136:8080

192.168.223.1 - - \[18/Jul/2017:10:21:25 +0800\] “GET /favicon.ico HTTP/1.1” **192.168.223.136:8080** 404 24 “http://192.168.223.136:8080/proxy\_path/index.html” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36” “-”

由于我将后端服务器关闭了，所以出现502网管错误：

然后开启137后端nginx，查看日志：

192.168.223.136 “192.168.223.1” - - \[17/Jul/2017:17:06:44 +0800\] “GET /index.html HTTP/1.0” **“192.168.223.136”** 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko” “192.168.223.1”

即验证了proxy\_set\_header Host $host; $host就是nginx代理服务器，也就是客户端请求的host。

**2、proxy\_set\_header Host $proxy\_host;**

将设置修改为上述 proxy\_host 然后重启ngxin代理服务器136

\[root@wadeson nginx\]\# sbin/nginx -s reload

重新请求代理页面：http://192.168.223.136:8080/proxy\_path/index.html，然后日志如下：

首先查看136代理服务器的日志：

192.168.223.1 - - \[18/Jul/2017:10:30:12 +0800\] “GET /proxy\_path/index.html HTTP/1.1” **192.168.223.136:8080** 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36” “-”

因为win10是136的客户端，请求的host为192.168.223.136:8080，而nginx代理服务器作为137后端服务器的客户端，将请求的报文首部重新封装，将proxy\_host封装为请求的host

那么137上面日志请求的host就是其自身，proxy\_host就是代理服务器请求的host也就是后端服务器137

192.168.223.136 “192.168.223.1” - - \[18/Jul/2017:10:30:12 +0800\] “GET /index.html HTTP/1.0” “**192.168.223.137**” 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36” “192.168.223.1”

**3、proxy\_set\_header Host  h o s t : host: host:proxy\_port;**

了解了上面的知识，那么此处对应的host就知道代表的啥了， h o s t 代 表 转 发 服 务 器 ， host代表转发服务器， host代表转发服务器，proxy\_port代表136转发服务器请求后端服务器的端口，也就是80

于是观察136、137的日志进行验证：

192.168.223.1 - - \[18/Jul/2017:10:38:38 +0800\] “GET /proxy\_path/index.html HTTP/1.1” **192.168.223.136:8080** 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36” “-”

192.168.223.136 “192.168.223.1” - - \[18/Jul/2017:10:38:38 +0800\] “GET /index.html HTTP/1.0” **“192.168.223.136:80”** 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36” “192.168.223.1”

**4、proxy\_set\_header X-Real-IP $remote\_addr;**

将 r e m o t e a d d r 的 值 放 进 变 量 X − R e a l − I P 中 ， 此 变 量 名 可 变 ， remote\_addr的值放进变量X-Real-IP中，此变量名可变， remoteaddr的值放进变量X−Real−IP中，此变量名可变，remote\_addr的值为客户端的ip

nginx转发136服务器日志格式为：

log\_format main '$remote\_addr -  r e m o t e u s e r \[ remote\_user \[ remoteuser\[time\_local\] “$request” KaTeX parse error: Double superscript at position 13: http\_host ' '̲status  b o d y b y t e s s e n t " body\_bytes\_sent " bodybytessent"http\_referer" ’  
‘“ h t t p u s e r a g e n t " " http\_user\_agent" " httpuseragent""http\_x\_forwarded\_for”’;

nginx后端137服务器的日志格式：

log\_format main ' r e m o t e a d d r ∗ ∗ " remote\_addr \*\*" remoteaddr∗∗"http\_x\_real\_ip"\*\* -  r e m o t e u s e r \[ remote\_user \[ remoteuser\[time\_local\] “ r e q u e s t " " request" " request""http\_host” ’  
'$status  b o d y b y t e s s e n t " body\_bytes\_sent " bodybytessent"http\_referer" ’  
‘“ h t t p u s e r a g e n t " " http\_user\_agent" " httpuseragent""http\_x\_forwarded\_for”’;

两者区别在于\*\*“$http\_x\_real\_ip”，添加了这个变量的值\*\*

**重新请求需要访问的地址http://192.168.223.136:8080/proxy\_path/index.html**

**136的日志：**

**192.168.223.1 - - \[18/Jul/2017:10:45:07 +0800\] “GET /proxy\_path/index.html HTTP/1.1” 192.168.223.136:8080 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36” “-”**

**137的日志：**

**192.168.223.136 “192.168.223.1” - - \[18/Jul/2017:10:45:07 +0800\] “GET /index.html HTTP/1.0” “192.168.223.136:80” 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36” “192.168.223.1”**

**红色标记的就是"$http\_x\_real\_ip"的值，即可以看见用户真实的ip，也就是客户端的真实ip。**

**5、proxy\_set\_header X-Forwarded-For $remote\_addr;**

**理解了上面的含义那么这个封装报文的意思也就请求了**

**首先还是比对136和137的日志格式：**

**136代理服务器的日志格式：**

log\_format main '$remote\_addr -  r e m o t e u s e r \[ remote\_user \[ remoteuser\[time\_local\] “$request” KaTeX parse error: Double superscript at position 13: http\_host ' '̲status  b o d y b y t e s s e n t " body\_bytes\_sent " bodybytessent"http\_referer" ’  
‘“ h t t p u s e r a g e n t " ∗ ∗ " http\_user\_agent" \*\*" httpuseragent"∗∗"http\_x\_forwarded\_for”\*\*’;

137后端服务器的日志格式：

log\_format main ' r e m o t e a d d r " remote\_addr " remoteaddr"http\_x\_real\_ip" -  r e m o t e u s e r \[ remote\_user \[ remoteuser\[time\_local\] “ r e q u e s t " " request" " request""http\_host” ’  
'$status  b o d y b y t e s s e n t " body\_bytes\_sent " bodybytessent"http\_referer" ’  
‘“ h t t p u s e r a g e n t " ∗ ∗ " http\_user\_agent" \*\*" httpuseragent"∗∗"http\_x\_forwarded\_for”\*\*’;

**重新请求需要访问的地址http://192.168.223.136:8080/proxy\_path/index.html**

**136的日志显示：**

**192.168.223.1 - - \[18/Jul/2017:10:51:25 +0800\] “GET /proxy\_path/index.html HTTP/1.1” 192.168.223.136:8080 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36” “-”，最后一个字段"$http\_x\_forwarded\_for"对应的为空值**

**137的日志显示：**

**192.168.223.136 “192.168.223.1” - - \[18/Jul/2017:10:51:25 +0800\] “GET /index.html HTTP/1.0” “192.168.223.136:80” 304 0 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36” “192.168.223.1”**

**可以看出137后端服务器成功的显示了真实客户端的ip。**

**6、proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;**

**5、6两者的区别：**

**在只有一个代理服务器的转发的情况下，两者的效果貌似差不多，都可以真实的显示出客户端原始ip**

**但是区别在于：**

KaTeX parse error: Double subscript at position 12: proxy\_add\_x\_̲forwarded\_for变量…remote\_addr两部分，他们之间用逗号分开。

举个例子，有一个web应用，在它之前通过了两个nginx转发，www.linuxidc.com 即用户访问该web通过两台nginx。

在第一台nginx中,使用

proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;

现在的KaTeX parse error: Double subscript at position 12: proxy\_add\_x\_̲forwarded\_for变量…remote\_addr，而$remote\_addr的值是用户的ip，于是赋值以后，X-Forwarded-For变量的值就是用户的真实的ip地址了。

到了第二台nginx，使用

proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;

现在的KaTeX parse error: Double subscript at position 12: proxy\_add\_x\_̲forwarded\_for变量…remote\_addr部分的值是上一台nginx的ip地址，于是通过这个赋值以后现在的X-Forwarded-For的值就变成了

“用户的真实ip，第一台nginx的ip”。

参考链接：  
http://t.zoukankan.com/gxyandwmm-p-12060274.html

[http_192.168.223.136_8080_proxy_path_index.html]: http://192.168.223.136:8080/proxy_path/index.html