用Nginx+Lua实现高性能、高可靠、安全的登陆验证

朴灿烈づ我的快乐病毒、 2023-10-17 14:14 2阅读 0赞

对于一个中型或大型网站，有n个子项目在不同的服务器甚至不同的IDC部署和运行，SSO（单点登录）和无SESSION已经是必备的功能。在这种情况下用户登陆后的身份验证就会是一个问题。一种简单的解决办法就是登陆时将用户的身份写入cookie，为了安全再写入一个cookie的校验，防止cookie篡改。

1 <?php  
2 $secretkey = '1234567890abcdefghi';  
3 // …… 取出数据到 $data 的代码略去  
4 **if**( **md5**( **sha1**( $password ) ) == $data\[ 'passowrd'\] ) \{ // 登陆成功  
5 $\_COOKIE\[ 'uid'\] = 1234;  
6 $\_COOKIE\[ 'nickname'\] = 'soga';  
7 $\_COOKIE\[ 'token'\] = **md5**( "uid:1234&nickname:soga&secretkey:1234567890abcdefghi" );  
8 \}  
9 ?>

验证登陆合法性:

01 <?php  
02 $secretkey = '1234567890abcdefghi';  
03  
04 **if**( $\_COOKIE\[ 'token'\] == **md5**( "uid: \{  $\_COOKIE\[ 'uid'\] \} &nickname: \{  $\_COOKIE\[ 'nickname'\] \} &secretkey: \{  $secretkey \} " ) ) \{  
05 $login = **true**;  
06 \}  
07 **else** \{  
08 $login = **false**;  
09 \}  
10 ?>

这样实现有一些问题存在，密钥$secretkey会暴露在所有的程序内，存在安全隐患。所有产品的程序中都需要内置token校验的[算法][Link 1]。

如果能在webserver层进行校验，直接告诉应用层校验结果，就可以避免上面的问题。找一种webserver上安全、稳定、高性能的实现，并且开发成本低的方案。我选择的是Nginx + ngx\_lua。Nginx的稳定性、高性能搭配Lua的高性能、低成本开发，简直绝配。

Nginx+ngx\_lua的编译安装就不在这里讲了。

Nginx 配置：

1 **access\_by\_lua\_file** '/dir/test.lua';

test.lua 代码：

01 **local** secretkey= ' 1234567890abcdefghi'  
02 **if** ngx.var.cookie\_uid == **nil** **or** ngx.var.cookie\_nickname == **nil** **or** ngx.var.cookie\_token== **nil** **then**  
03 ngx.req.set\_header( " Check-Login", " NULL")  
04 **return**  
05 **end**  
06  
07 **local** ctoken = ngx.md5( ' uid:' .. ngx.var.cookie\_uid .. ' &nickname:' ..ngx.var.cookie\_nickname .. ' &secretkey:' .. secretkey)  
08  
09 **if** ctoken == ngx.var.cookie\_token **then**  
10 ngx.req.set\_header( " Check-Login", " Yes")  
11 **else**  
12 ngx.req.set\_header( " Check-Login", " No")  
13 **end**  
14  
15 **return**

然后就可以[测试][Link 2]一下了：

无cookie登陆测试

01 \[root@localhost soft\]\# **curl -v "http://yuenshui.com:88/test.php"**  
02 \* About to connect() to yuenshui.com port 88  
03 \* Trying 122.0.66.162… connected  
04 \* Connected to yuenshui.com (122.0.66.162) port 88  
05 > GET /test.php HTTP/1.1  
06 > User-Agent: curl/7.15.5 (x86 **\_**64-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5  
07 > Host: yuenshui.com:88  
08 > Accept: \*/\*  
09 >  
10 < HTTP/1.1 200 OK  
11 < Server: nginx  
12 < Date: Sun, 24 Jun 2012 10:38:09 GMT  
13 < Content-Type: application/octet-stream  
14 < Transfer-Encoding: chunked  
15 < Connection: keep-alive  
16 nil  
17 <pre> $ **\_SERVER:**  
18 **Array**  
19 (  
20 \[ **TMP**\] = **>** / **tmp**  
21 \[ **TMPDIR**\] = **>** / **tmp**  
22 \[ **TEMP**\] = **>** / **tmp**  
23 \[ **OSTYPE**\] = **>**   
24 \[ **MACHTYPE**\] = **>**   
25 \[ **MALLOC\_CHECK\_**\] = **>**  2  
26 \[ **USER**\] = **> www**  
27 \[ **HOME**\] = **>** / **home**/ **www**  
28 \[ **FCGI\_ROLE**\] = **> RESPONDER**  
29 \[ **SERVER\_SOFTWARE**\] = **> nginx**  
30 \[ **QUERY\_STRING**\] = **>**   
31 \[ **REQUEST\_METHOD**\] = **> GET**  
32 \[ **CONTENT\_TYPE**\] = **>**   
33 \[ **CONTENT\_LENGTH**\] = **>**   
34 \[ **SCRIPT\_NAME**\] = **>** / **test.php**  
35 \[ **REQUEST\_URI**\] = **>** / **test.php**  
36 \[ **DOCUMENT\_URI**\] = **>** / **test.php**  
37 \[ **SERVER\_PROTOCOL**\] = **> HTTP**/ 1 **.** 1  
38 \[ **REMOTE\_ADDR**\] = **>**  114 **.** 93 **.** 76 **.** 130  
39 \[ **REMOTE\_PORT**\] = **>**  1037  
40 \[ **SERVER\_ADDR**\] = **>**  122 **.** 0 **.** 66 **.** 162  
41 \[ **SERVER\_PORT**\] = **>**  88  
42 \[ **SERVER\_NAME**\] = **> yuenshui.com**  
43 \[ **REDIRECT\_STATUS**\] = **>**  200  
44 \[ **HTTP\_USER\_AGENT**\] = **> curl**/ 7 **.** 15 **.** 5 ( **x** 86 **\_** 64\- **redhat**\- **linux**\- **gnu**)  **libcurl**/ 7 **.** 15 **.** 5 **OpenSSL**/ 0 **.** 9 **.** 8 **b zlib**/ 1 **.** 2 **.** 3  **libidn**/ 0 **.** 6 **.** 5  
45 \[ **HTTP\_HOST**\] = **> yuenshui.com:** 88  
46 \[ **HTTP\_ACCEPT**\] = **>** \*/\*  
47 **\[HTTP\_CHECK\_LOGIN\] => NULL**  
48 \[ **PHP\_SELF**\] = **>** / **test.php**  
49 \[ **REQUEST\_TIME**\] = **>**  1340534289  
50 \[ **argv**\] = **> Array**  
51 (  
52 )  
53  
54 \[ **argc**\] = **>**  0  
55 )  
56  
57 $ **\_**COOKIE:  
58 Array  
59 (  
60 )

token错误的测试：

01 \[root@localhost soft\]\# curl -b "uid=12345;nickname=soga;token=aa6f21ec0fcf008aa5250904985a817b" "http://yuenshui.com:88/test.php"  
02 <pre> $ **\_SERVER:**  
03 **Array**  
04 (  
05 \[ **TMP**\] = **>** / **tmp**  
06 \[ **TMPDIR**\] = **>** / **tmp**  
07 \[ **TEMP**\] = **>** / **tmp**  
08 \[ **OSTYPE**\] = **>**   
09 \[ **MACHTYPE**\] = **>**   
10 \[ **MALLOC\_CHECK\_**\] = **>**  2  
11 \[ **USER**\] = **> www**  
12 \[ **HOME**\] = **>** / **home**/ **www**  
13 \[ **FCGI\_ROLE**\] = **> RESPONDER**  
14 \[ **SERVER\_SOFTWARE**\] = **> nginx**  
15 \[ **QUERY\_STRING**\] = **>**   
16 \[ **REQUEST\_METHOD**\] = **> GET**  
17 \[ **CONTENT\_TYPE**\] = **>**   
18 \[ **CONTENT\_LENGTH**\] = **>**   
19 \[ **SCRIPT\_NAME**\] = **>** / **test.php**  
20 \[ **REQUEST\_URI**\] = **>** / **test.php**  
21 \[ **DOCUMENT\_URI**\] = **>** / **test.php**  
22 \[ **SERVER\_PROTOCOL**\] = **> HTTP**/ 1 **.** 1  
23 \[ **REMOTE\_ADDR**\] = **>**  114 **.** 93 **.** 76 **.** 130  
24 \[ **REMOTE\_PORT**\] = **>**  1059  
25 \[ **SERVER\_ADDR**\] = **>**  122 **.** 0 **.** 66 **.** 162  
26 \[ **SERVER\_PORT**\] = **>**  88  
27 \[ **SERVER\_NAME**\] = **> yuenshui.com**  
28 \[ **REDIRECT\_STATUS**\] = **>**  200  
29 \[ **HTTP\_USER\_AGENT**\] = **> curl**/ 7 **.** 15 **.** 5 ( **x** 86 **\_** 64\- **redhat**\- **linux**\- **gnu**)  **libcurl**/ 7 **.** 15 **.** 5 **OpenSSL**/ 0 **.** 9 **.** 8 **b zlib**/ 1 **.** 2 **.** 3  **libidn**/ 0 **.** 6 **.** 5  
30 \[ **HTTP\_HOST**\] = **> yuenshui.com:** 88  
31 \[ **HTTP\_ACCEPT**\] = **>** \*/\*  
32 \[ **HTTP\_COOKIE**\] = **> uid**= 12345 **;nickname**= **soga;token**= **aa** 6 **f** 21 **ec** 0 **fcf** 008 **aa** 5250904985 **a** 817b  
33 **\[HTTP\_CHECK\_LOGIN\] => No**  
34 \[ **PHP\_SELF**\] = **>** / **test.php**  
35 \[ **REQUEST\_TIME**\] = **>**  1340537366  
36 \[ **argv**\] = **> Array**  
37 (  
38 )  
39  
40 \[ **argc**\] = **>**  0  
41 )  
42  
43 $ **\_**COOKIE:  
44 Array  
45 (  
46 \[uid\] => 12345  
47 \[nickname\] => soga  
48 \[token\] => aa6f21ec0fcf008aa5250904985a817b  
49 )

token正确的测试：

01 \[root@localhost soft\]\# curl -b "uid=1234;nickname=soga;token=aa6f21ec0fcf008aa5250904985a817b" "http://yuenshui.com:88/test.php"  
02 <pre> $ **\_SERVER:**  
03 **Array**  
04 (  
05 \[ **TMP**\] = **>** / **tmp**  
06 \[ **TMPDIR**\] = **>** / **tmp**  
07 \[ **TEMP**\] = **>** / **tmp**  
08 \[ **OSTYPE**\] = **>**   
09 \[ **MACHTYPE**\] = **>**   
10 \[ **MALLOC\_CHECK\_**\] = **>**  2  
11 \[ **USER**\] = **> www**  
12 \[ **HOME**\] = **>** / **home**/ **www**  
13 \[ **FCGI\_ROLE**\] = **> RESPONDER**  
14 \[ **SERVER\_SOFTWARE**\] = **> nginx**  
15 \[ **QUERY\_STRING**\] = **>**   
16 \[ **REQUEST\_METHOD**\] = **> GET**  
17 \[ **CONTENT\_TYPE**\] = **>**   
18 \[ **CONTENT\_LENGTH**\] = **>**   
19 \[ **SCRIPT\_NAME**\] = **>** / **test.php**  
20 \[ **REQUEST\_URI**\] = **>** / **test.php**  
21 \[ **DOCUMENT\_URI**\] = **>** / **test.php**  
22 \[ **SERVER\_PROTOCOL**\] = **> HTTP**/ 1 **.** 1  
23 \[ **REMOTE\_ADDR**\] = **>**  114 **.** 93 **.** 76 **.** 130  
24 \[ **REMOTE\_PORT**\] = **>**  1059  
25 \[ **SERVER\_ADDR**\] = **>**  122 **.** 0 **.** 66 **.** 162  
26 \[ **SERVER\_PORT**\] = **>**  88  
27 \[ **SERVER\_NAME**\] = **> yuenshui.com**  
28 \[ **REDIRECT\_STATUS**\] = **>**  200  
29 \[ **HTTP\_USER\_AGENT**\] = **> curl**/ 7 **.** 15 **.** 5 ( **x** 86 **\_** 64\- **redhat**\- **linux**\- **gnu**)  **libcurl**/ 7 **.** 15 **.** 5 **OpenSSL**/ 0 **.** 9 **.** 8 **b zlib**/ 1 **.** 2 **.** 3  **libidn**/ 0 **.** 6 **.** 5  
30 \[ **HTTP\_HOST**\] = **> yuenshui.com:** 88  
31 \[ **HTTP\_ACCEPT**\] = **>** \*/\*  
32 \[ **HTTP\_COOKIE**\] = **> uid**= 1234 **;nickname**= **soga;token**= **aa** 6 **f** 21 **ec** 0 **fcf** 008 **aa** 5250904985 **a** 817b  
33 **\[HTTP\_CHECK\_LOGIN\] => Yes**  
34 \[ **PHP\_SELF**\] = **>** / **test.php**  
35 \[ **REQUEST\_TIME**\] = **>**  1340537463  
36 \[ **argv**\] = **> Array**  
37 (  
38 )  
39  
40 \[ **argc**\] = **>**  0  
41 )  
42  
43 $ **\_**COOKIE:  
44 Array  
45 (  
46 \[uid\] => 12345  
47 \[nickname\] => soga  
48 \[token\] => aa6f21ec0fcf008aa5250904985a817b  
49 )

http://yuenshui.com:88/test.[PHP][] 打印信息的[php][PHP]代码：

01 <pre><?php  
02 **echo** " \\$ \_SERVER: \\r\\n ";  
03 **unset**( $\_SERVER\[ 'SCRIPT\_FILENAME'\]);  
04 **unset**( $\_SERVER\[ 'DOCUMENT\_ROOT'\]);  
05 **unset**( $\_SERVER\[ 'PATH'\]);  
06 **unset**( $\_SERVER\[ 'HOSTNAME'\]);  
07 **unset**( $\_SERVER\[ 'GATEWAY\_INTERFACE'\]);  
08 **print\_r**( $\_SERVER);  
09 **echo** " \\r\\n\\$ \_COOKIE: \\r\\n ";  
10 **print\_r**( $\_COOKIE);  
11 ?>

上面是所有的测试程序。大家也可以通过curl进行测试http://yuenshui.com:88/test.php

来源:http://blog.csdn.net/langeldep/article/details/8629906/

[Link 1]: http://lib.csdn.net/base/datastructure
[Link 2]: http://lib.csdn.net/base/softwaretest
[PHP]: http://lib.csdn.net/base/php