条件必选nginx auth_request

Question

我想让我的nginx代理执行认证的子请求只有当客户端还没有被认证。有条件的部分是我卡住的地方。如何进行配置，使每个会话只对客户机进行一次身份验证?

我能够成功地执行一个auth_request到Apache，并拉回我想要传递到后端，但这是发生在每个请求和昂贵的头。

在这里的示例中，我的目标是仅在"Authorization"头缺失或为空或包含令牌

的cookie时才执行auth_request。

# DEFAULT BACKEND
    location / {
        proxy_pass_request_body off;
        if ($http_authorization ~* '')
        {
            rewrite ^(.*)$ /__login;
        }
        if ($user !~* "([aa-zZ]+)@example.com")
        {
        }
        if ($http_cookie !~* "(auth_cookie=([aa-zZ]+)@example.com)")
        {
            add_header Set-Cookie "auth_cookie=$user;domain=.example.com;Max-Age=3000";
        }
        proxy_pass_header x-webauth-user;
        proxy_pass_header Set-Cookie;
        proxy_pass http://example.com:6762/;
   }

location/__login {内部的;

    auth_request /auth;
    auth_request_set $user $upstream_http_x_webauth_user;
    set $xuser $user;
    add_header Auth-User $user;
    proxy_set_header User-Name $user;
    proxy_set_header Authorization $http_authorization;
    #proxy_pass_header x-webauth-user;
    #proxy_pass_header Set-Cookie;
    proxy_pass http://example:6762/;
    access_log /etc/nginx/login_debug.log;
   }

location = /auth{
    internal;
    proxy_pass http://example.com:81/;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-for $proxy_add_x_forwarded_for;
    #proxy_pass_header  Set-Cookie;
    #proxy_pass_header  x-webauth-user;
}

Auth-User头在第一个请求之后丢失，cookie似乎永远不会被设置，除此之外，页面实际上似乎不会在浏览器中呈现。我显然做错了什么，有人能帮我解决这个问题吗?

Answer 1

Nginx wiki警告location中的if可能会产生意想不到的结果，但rewrite ... last;是安全的。下面是一个例子:

location / {
    if ($cookie_UserName = "") {
        rewrite ^ /__login$uri last;
    }
    proxy_pass http://backend-app;
}
location /__login {  internal;
    rewrite ^/__login(?<realurl>/.*)$ $realurl break;
    auth_request /auth;
    auth_request_set $user $upstream_http_x_webauth_user;
    proxy_set_header Cookie UserName=$user;
    proxy_pass http://backend-app;
    add_header Set-Cookie "UserName=$user;Max-Age=300";
}
location = /auth {  internal;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_pass http://auth-server/validate;
}

有两种情况:Cookie:UserName是否存在。如果存在，则执行第一个proxy_pass。否则使用/__login。注意，$uri是通过的，所以它可以被发送到后端应用程序。

对于更高级的条件，可以使用map代替if。

请注意，如果不对每个请求进行身份验证，就有可能接受带有"伪造"的请求。饼干/头。

Answer 2

请查看NJS (https://nginx.org/en/docs/njs/)模块。这真的很简单，当然可以做你想做的。下面是示例解决方案:

文件:/etc/nginx/conf.d/default.conf:

server {
    listen 80;
    server_name "SOME_SERVER";
    # make an authentication subrequest for every request
    auth_request /auth;
    # create a new variable AuthToken and set its value to the res.SOMEVALUE from the later subrequest... 
    auth_request_set $AuthToken $sent_http_token;
    
    # add new AuthToken to the request
    proxy_set_header Authorization $AuthToken;
    location / {
        proxy_pass http://SOME_ENDPOINT;
    }
    location = /auth {
        internal;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
        js_content auth.main;
    }
    location /get-new-token-location {
       internal;
       proxy_pass http://SOMEURL;
    }
}

和nginx.conf文件的例子来展示如何启用NJS模块:

...
pid /var/run/nginx.pid;
load_module /usr/lib/nginx/modules/ngx_http_js_module.so;
events {
    use epoll;
    worker_connections 10000;
}

http {
    # import njs scripts
    js_import auth from /path/to/the/auth.js;
    
    include /etc/nginx/conf.d/default.conf;
}

最后，auth.js文件中的主函数:

export default {main}
function main(r) {
    var token = "";
    // search token in Authorization header
    if (this.requestHeaderExists(r, 'Authorization')) {
        var m = r.headersIn.Authorization.match(/Bearers+(.+)/);
        if (m !== null && typeof m[1] !== 'undefined') {
            token = m[1];
        }
    }
    // search token in cookie
    if (token.length == 0) {
       ... code here ...
    }
    // token was found, you can somehow validate it if you want
    if (token.length > 0) {
       .., make sure token is valid...
    }
    else { // there is no token, so ask for the new one
       r.subrequest('/get-new-token-location, { method: 'GET' }, function(reply) {  
         var res = JSON.parse(reply.responseBody);
         // add token to the response headers of this sub-request
         r.headersOut['token'] = res.SOMEVALUE;
       }
    }
   r.return(200);
   return;
}

请把它当作一个例子。好吧，也许它看起来很复杂，但它真的很强大，你肯定可以在万维网上找到更多的例子。

Answer 3

也许太晚了。但我找到了另一个解决办法。使用proxy_cache缓存auth_request .

# Working config for auth_request with proxy_cache. (nginx 1.18.0)
# https://gist.github.com/jinto/f120e497db8d39d866db49ff2454b7b3
# ...
proxy_cache_path /tmp/cache_xx levels=1:2 keys_zone=auth_cache:10m max_size=128m inactive=10m use_temp_path=off;
server {
  location / {
    auth_request /_ml_proxy/auth;
    # ...
    proxy_pass http://backend_ip:7860/;
  }
  location ~ ^/_ml_proxy/auth { internal;
    include                 proxy_params;
    proxy_cache             auth_cache;
    proxy_cache_methods     GET HEAD POST;
    proxy_cache_key         $cookie_sessionid;   # for django
    proxy_cache_valid       200 1m;
    proxy_pass              http://backend_auth_ip;
    proxy_pass_request_body off;
    proxy_set_header        Content-Length "";
  }
}