我有一个 AWS 弹性负载均衡器,它接收域 (bunny.misite.dev) 的 https 请求,请求通过 http 发送到服务器 Nginx,Laravel 应用程序回答请求。
我遇到的问题是 Laravel 没有将请求识别为 Https,而是将请求识别为 http。
为了解决这个问题,Laravel 提供了一个我使用过的“可信代理”中间件:
<?php
namespace App\Http\Middleware;
use Fideloper\Proxy\TrustProxies as Middleware;
use Illuminate\Http\Request;
class TrustProxies extends Middleware
{
/**
* The trusted proxies for this application.
*
* @var array|string|null
*/
protected $proxies = '*';
/**
* The headers that should be used to detect proxies.
*
* @var int
*/
protected $headers = Request::HEADER_X_FORWARDED_FOR |
Request::HEADER_X_FORWARDED_HOST |
Request::HEADER_X_FORWARDED_PORT |
Request::HEADER_X_FORWARDED_PROTO |
Request::HEADER_X_FORWARDED_AWS_ELB;
}
我的 nginx 配置是
server {
listen 80 ;
listen [::]:80 ;
server_name bunny.misite.dev;
server_tokens off;
error_log /home/main/logs/nginx/bunny-master_error.log;
access_log /home/main/logs/nginx/bunny-master_access.log main buffer=16k;
access_log /var/log/nginx-rc/bunny-master_traffic.log traffic;
client_max_body_size 256m;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
root /home/main/webapps/bunny-master/live/public;
index index.php index.html index.htm;
location / {
proxy_send_timeout 60;
proxy_read_timeout 60;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_connect_timeout 30s;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Server-Addr $server_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_pass http://backend;
}
location ~ /\. {
deny all;
access_log off;
log_not_found off;
}
location = /favicon.ico {
log_not_found off;
}
location @proxy {
proxy_send_timeout 60;
proxy_read_timeout 60;
proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_connect_timeout 30s;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Server-Addr $server_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://backend;
}
}
Laravel >= 5.5 已经使用
fideloper/TrustedProxies
,所以它应该尊重X-Forwarded-Proto
header 来决定客户端请求是使用 HTTP 还是 HTTPS。您的 nginx 配置仍然指定
X-Forwarded-Proto
为,http
因为:proxy_set_header X-Forwarded-Proto
to$scheme
,这是 AWS ELB 在客户端请求时使用的 URL 方案,并且要解决此问题,您可以:
proxy_set_header X-Forwarded-Proto
为$http_x_forwarded_proto
. AWS ELB应该X-Forwarded-Proto
在进行转发请求时将请求标头从客户端发送到 nginx。如果您确定 AWS ELB 将始终只转发 HTTPS 请求,您甚至可以设置proxy_set_header X-Forwarded-Proto
为https
.