HTTP请求头中的X-Forwarded-For介绍 概述
我们在做nginx⽅向代理的时候,为了记录整个代理过程,我们往往会在配置⽂件中加上如下配置: location ^~ /app/download/ {
...
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
...
proxy_pass 10.1.10.203:8080;
}
proxy_set_header就是记录整个代理过程的配置。其中X-Forwarded-For(XFF)位于HTTP请求头,已经成为事实上的标准。
XFF的请求格式很简单,如下:
金鸡奖2017
X-Forwarded-For: client, proxy1, proxy2
由上⾯可以看到XFF的的内容由[IP+英⽂逗号+空格]组成(如果有多个代理的话),最开始的client是客户端的IP,proxy1和proxy2分别是⼀级代理和⼆级代理的IP。
假设代理如下:
中铁航空港如上,proxy1、proxy2和proxy3都⽤NG做反代,并且在它们的配置上都加上如下配置:
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
那么在Real Server(NG的WEB容器)上打印的⽇志(⽇志⾥带$http_x_forwarded_for)就会带有IP0,IP1,IP2的HTTP头,可以看到没有IP3,因为IP3是直连服务器,它会给XFF追加IP2的地址,表⽰它是帮proxy2做转发的,Real Server要获取IP3的地址,需通过remote Address字段获得。 同理,在proxy3上⽇志⾥只会有IP0和IP1,proxy2上⽇志⾥只有IP0,proxy1上没有IP。as if 用法
测试
测试拓扑如下:
在proxy1上的配置如下:
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass 192.168.169.130/;
}
}
在proxy2上的配置如下:
server {
listen 80 default_server;
下行频率
listen [::]:80 default_server;
server_name _;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass 192.168.169.131/;
}
}
在proxy3的配置如下:
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
root /usr/share/nginx/html;
# Load configuration files for the default server block.
include /etc/nginx/default.d/*.conf;
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass x:8888/;
}
}
proxy1,proxy2,proxy3上的⽇志格式如下:
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
Real Server⽇志格式如下:
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent $upstream_cache_status "$http_referer" '
'"$http_user_agent" "==$http_x_forwarded_for" "--$http_x_real_ipi"';
192.168.169.1 - - [04/Jun/2019:10:57:06 +0800] "GET / HTTP/1.1" 200 20 "-"
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/74.0.3729.169 Safari/537.36" "-"
proxy2⽇志:
192.168.169.128 - - [04/Jun/2019:10:57:06 +0800] "GET / HTTP/1.0" 200 10 "-"
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/74.0.3729.169 Safari/537.36" "192.168.169.1"
proxy3⽇志:
柔道教学
192.168.169.130 - - [29/Mar/2019:23:29:36 +0800] "GET / HTTP/1.0" 200 10 "-"仙鹤草酚b
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/74.0.3729.169 Safari/537.36" "192.168.169.1, 192.168.169.128"
Real Server⽇志:
183.66.224.50 - - [04/Jun/2019:10:57:03 +0800] "GET / HTTP/1.0" 200 10 - "-"
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/74.0.3729.169 Safari/537.36" "==192.168.169.1, 192.168.169.128, 192.168.169.130" "---"
从上⾯的⽇志可以知道:
(1)、设置X-Forwarded-For是⼀个可叠加的过程;
(2)、后端服务器XFF获取不到直连服务器IP。⽐如Real-Server的⽇志中XFF字段没有proxy3的IP地址,依次类推;(3)、代理中要配置proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;