nginx 反身代理-cookie 共享

阅读更多

 

   nginx 代理N个服务，通过URL上下文区分，其中一个服务是登录服务，写cookie.

    api服务：http:/www.domain.com/api

    SSO服务：http://www.domain.com/sso

    前端服务：http://www.domain.com/front 

 

   登录成功后，sso服务写cookie:

   

Set-Cookie:

 

SESSION=YmUyMDMwMGItZjc1ZC00ZmE1LWIwNmQtYTljMTczNWFhNDE3; Path=/sso/; HttpOnly; SameSite=Lax

 

 

 

前端服务提交请求时，在/front不能使用/sso下的cookie,所以造成登录无效。

 

 

所以需要/sso 服务，写cookie时，把 cooke的 Path=/sso/ 改为==》 Path=/; /front才能使用该 cookie .

 

 

 

实现方式 nginx

 

 

location /sso{

 

proxy_pass http://sso proxy_http_version 1.1;

 

proxy_set_header X-Real-IP $remote_addr;

 

proxy_set_header Host $host; proxy_set_header

 

Connection keep-alive; proxy_set_header Keep-Alive 600;

 

keepalive_timeout 600;

 

proxy_cookie_path /sso/ /;

 

}

 

 

nginx 官方文档：http://nginx.org/en/docs/http/ngx_http_proxy_module.html?&_ga=1.161910972.1696054694.1422417685#proxy_cookie_path

 

Syntax:	proxy_cookie_path off;
proxy_cookie_path path replacement;
Default:	
proxy_cookie_path off;
Context:	http, server, location
This directive appeared in version 1.1.15.

Sets a text that should be changed in the path attribute of the “Set-Cookie” header fields of a proxied server response. Suppose a proxied server returned the “Set-Cookie” header field with the attribute “path=/two/some/uri/”. The directive

proxy_cookie_path /two/ /;
will rewrite this attribute to “path=/some/uri/”.

The path and replacement strings can contain variables:

proxy_cookie_path $uri /some$uri;
The directive can also be specified using regular expressions. In this case, path should either start from the “~” symbol for a case-sensitive matching, or from the “~*” symbols for case-insensitive matching. The regular expression can contain named and positional captures, and replacement can reference them:

proxy_cookie_path ~*^/user/([^/]+) /u/$1;
There could be several proxy_cookie_path directives:

proxy_cookie_path /one/ /;
proxy_cookie_path / /two/;
The off parameter cancels the effect of all proxy_cookie_path directives on the current level:

proxy_cookie_path off;
proxy_cookie_path /two/ /;
proxy_cookie_path ~*^/user/([^/]+) /u/$1;