使用openresty通过lua修改请求/响应头
openresty介绍
在使用nginx时，如果我们想进行开发，开发难度比较大，openresty对nginx核心集成了很多lua三方模块，开发者可以使用lua脚本进行开发，开发者只需了解http协议和lua脚本。openresty你可以理解为支持lua开发的nginx,但是性能比nginx强。
openresty可提供：均衡负载、请求路由、安全认证、服务鉴权、流量控制、日志监控服务等。
根据openresty官网提供的数据表明：openresty在单机上就可以支持1万~100万并发连接。
mac安装oepnresty
安装
// 使用brew 安装
brew install openresty/brew/openresty
// 上面安装完后，执行nginx 提示找不到命令
// 配置环境变量(会话级,关闭这个会话，变量失效)
export PATH = /usr/local/opt/openresty/nginx/sbin:$PATH
安装完成后
// 启动
sudo nginx -c /usr/local/etc/openresty/nginx/nginx.conf
// 重载配置文件
sudo nginx -s reload -c /usr/local/etc/openresty/nginx/nginx.conf
//检查配置文件语法
sudo nginx -t /usr/local/etc/openresty/nginx/nginx.conf
// 停止
sudo nginx -s stop
卸载
// brew 卸载openresty
brew uninstall --force openresty/brew/openresty
linux安装openresty
// 安装依赖库
apt-get install libreadline-dev libpcre3-dev libssl-dev perl
// 下载
wget https://openresty.org/download/ngx_openresty-1.9.7.1.tar.gz
// 解压
tar xzvf ngx_openresty-1.9.7.1.tar.gz
//进入解压后的目录
cd ngx_openresty-1.9.7.1/
// 安装
./configure
make
make install
默认情况下程序会被安装到 /usr/local/openresty, 你可以使用./configure --help查看会更多的配置选项
openresty的lua时序图
init_by_lua
- 用法
当启动nginx的master进程加载配置文件时可以执行init_by_lua这里定义的lua脚本。 - 语法
init_by_lua <lua-script-str>
- 示例
// nginx.conf
location / {
init_by_lua 'your code';
}
- init_by_lua_block语法
init_by_lua_block {
lua-script }
- init_by_lua_file语法
init_by_lua_file <path-lua-script>
init_worker_by_lua
-
用法
当nginx的master进程启动后，每一个woker进程启动时执行这里定义的脚本。 -
语法
init_worker_by_lua <lua-script-str>
- 示例
// nginx.conf
location / {
init_worker_by_lua 'your code';
}
- init_worker_by_lua_block语法
init_worker_by_lua_block {
lua-script}
- init_worker_by_lua_file语法
init_worker_by_lua_file <lua-file-path>
set_by_lua
- 用法
执行指定脚本和输入的值返回一个结果 - 语法
set_by_lua $res [$arg1 $arg2...]
- 示例
location /foo {
set $diff ''; # we have to predefine the $diff variable here
set_by_lua $sum '
local a = 32
local b = 56
ngx.var.diff = a - b; -- write to $diff directly
return a + b; -- return the $sum value normally
';
echo "sum = $sum, diff = $diff";
}
- set_by_lua_block语法
set_by_lua_block $res [lua-script]
- set_by_lua_file语法
set_by_lua-file $res <path-to-lua-script-file> [$arg1 $arg2...]
rewite_by_lua
-
用法
执行Lua脚本重写每一个请求，注意这个处理器的时序必须在标准的 ngx_http_rewrite_module模块之后执行。 -
语法
rewrite_by_lua
-
示例
正确执行
location /foo {
set $a 12; # create and initialize $a
set $b ""; # create and initialize $b
rewrite_by_lua 'ngx.var.b = tonumber(ngx.var.a) + 1';
echo "res = $b";
}
没有按照期望执行
location /foo {
? set $a 12; # create and initialize $a
? set $b ''; # create and initialize $b
? rewrite_by_lua 'ngx.var.b = tonumber(ngx.var.a) + 1';
? if ($b = '13') {
? rewrite ^ /bar redirect;
? break;
? }
?
? echo "res = $b";
? }
因为 if 运行在 rewrite_by_lua之前即使代码看起在其后执行.
- rewrite_by_lua_block语法
rewrite_by_lua_block {lua-script}
- rewrite_by_lua_file语法
rewrite_by_lua_file
access_by_lua
-
用法
执行Lua脚本可以修改每一个请求头，注意这个处理器的时序必须在标准的 ngx_http_access_module模块之后执行。 -
语法
access_by_lua
- 示例
location / {
deny 192.168.1.1;
allow 192.168.1.0/24;
allow 10.1.1.0/16;
deny all;
access_by_lua '
local res = ngx.location.capture("/mysql", { ... })
...
';
# proxy_pass/fastcgi_pass/...
}
- access_by_lua_block语法
access_by_lua_block {lua-script}
- access_by_lua_file语法
// 如果写相对地址，相对于nginx根目录
acess_by_lua_file
// 这里地址推荐使用绝对地址
header_filter_by_lua
- 用法
执行Lua脚本修改每一个请求的响应头信息
- 语法
header_filter_by_lua
- 示例
location / {
proxy_pass http://mybackend;
header_filter_by_lua 'ngx.header.Foo = "blah"';
}
- header_filter_by_lua_block语法
header_filter_by_lua_block {lus-script}
- header_filter_by_lua_file语法
header_filter_by_lua_file
body_filter_by_lua
- 用法
执行Lua脚本修改每一个请求的响应body信息 - 语法
body_filter_by_lua
- 示例
location / {
proxy_pass http://mybackend;
body_filter_by_lua 'ngx.arg[1] = string.upper(ngx.arg[1])';
}
- body_filter_by_lua_block语法
body_filter_by_lua_block {lua-script-str}
- body_filter_by_lua_file语法
body_filter_by_lua_file
修改请求头
如果请求头有 authorization并且他的值包含Bearer,则重写值,我们这里使用access_by_lua_file
nignx.conf
location / {
access_by_lua_file lua/changeReqHeader.lua;
}
changeReqHeader.lua
-- 重写请求头 token
-- 如果请求头包含 authorization 并且内容包含 Bearer，则重写请求头
local token = '123456'
if ngx.req.get_headers()["authorization"] ~= nil and string.find(ngx.req.get_headers()["authorization"], 'Bearer') ~= nil then
ngx.req.set_header("authorization", "Bearer "..token)
-- ngx.log(ngx.ERR, "token:"..token)
end
修改响应头
如果响应码时401，响应头有authenticate,则修改这个值,我们这里使用 header_filter_by_lua_file
nignx.conf
location / {
header_filter_by_lua_file lua/changeRrespHeader.lua;
}
changeRrespHeader.lua
if ngx.status == 401 then
local h = ngx.resp.get_headers()
for k, v in pairs(h) do
if k == "www-authenticate" then
ngx.header["www-authenticate"] = "Bearer realm=\"http://xxx-xxx.com.cn/service/token\",service=\"harbor-registry\""
end
end
end
nginx提供给lua的API
在lua脚本中可以使用下面的API进行开发。
http方法
上下文使用lua时序方法 init_by_lua*, set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*, ngx.timer., balancer_by_lua, ssl_certificate_by_lua*, ssl_session_fetch_by_lua*, ssl_session_store_by_lua*
ngx.HTTP_GET
ngx.HTTP_HEAD
ngx.HTTP_PUT
ngx.HTTP_POST
ngx.HTTP_DELETE
http状态码
上下文使用Lua时序方法init_by_lua*, set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*, ngx.timer., balancer_by_lua, ssl_certificate_by_lua*, ssl_session_fetch_by_lua*, ssl_session_store_by_lua*
value = ngx.HTTP_CONTINUE (100) (first added in the v0.9.20 release)
value = ngx.HTTP_SWITCHING_PROTOCOLS (101) (first added in the v0.9.20 release)
value = ngx.HTTP_OK (200)
value = ngx.HTTP_CREATED (201)
value = ngx.HTTP_ACCEPTED (202) (first added in the v0.9.20 release)
value = ngx.HTTP_NO_CONTENT (204) (first added in the v0.9.20 release)
value = ngx.HTTP_PARTIAL_CONTENT (206) (first added in the v0.9.20 release)
value = ngx.HTTP_SPECIAL_RESPONSE (300)
value = ngx.HTTP_MOVED_PERMANENTLY (301)
value = ngx.HTTP_MOVED_TEMPORARILY (302)
value = ngx.HTTP_SEE_OTHER (303)
value = ngx.HTTP_NOT_MODIFIED (304)
value = ngx.HTTP_TEMPORARY_REDIRECT (307) (first added in the v0.9.20 release)
value = ngx.HTTP_PERMANENT_REDIRECT (308)
value = ngx.HTTP_BAD_REQUEST (400)
value = ngx.HTTP_UNAUTHORIZED (401)
value = ngx.HTTP_PAYMENT_REQUIRED (402) (first added in the v0.9.20 release)
value = ngx.HTTP_FORBIDDEN (403)
value = ngx.HTTP_NOT_FOUND (404)
value = ngx.HTTP_NOT_ALLOWED (405)
value = ngx.HTTP_NOT_ACCEPTABLE (406) (first added in the v0.9.20 release)
value = ngx.HTTP_REQUEST_TIMEOUT (408) (first added in the v0.9.20 release)
value = ngx.HTTP_CONFLICT (409) (first added in the v0.9.20 release)
value = ngx.HTTP_GONE (410)
value = ngx.HTTP_UPGRADE_REQUIRED (426) (first added in the v0.9.20 release)
value = ngx.HTTP_TOO_MANY_REQUESTS (429) (first added in the v0.9.20 release)
value = ngx.HTTP_CLOSE (444) (first added in the v0.9.20 release)
value = ngx.HTTP_ILLEGAL (451) (first added in the v0.9.20 release)
value = ngx.HTTP_INTERNAL_SERVER_ERROR (500)
value = ngx.HTTP_METHOD_NOT_IMPLEMENTED (501)
value = ngx.HTTP_BAD_GATEWAY (502) (first added in the v0.9.20 release)
value = ngx.HTTP_SERVICE_UNAVAILABLE (503)
value = ngx.HTTP_GATEWAY_TIMEOUT (504) (first added in the v0.3.1rc38 release)
value = ngx.HTTP_VERSION_NOT_SUPPORTED (505) (first added in the v0.9.20 release)
value = ngx.HTTP_INSUFFICIENT_STORAGE (507) (first added in the v0.9.20 release)
删除nginx日志级别
上下文使用Lua时序方法init_by_lua*, init_worker_by_lua*, set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*, ngx.timer., balancer_by_lua, ssl_certificate_by_lua*, ssl_session_fetch_by_lua*, ssl_session_store_by_lua*
//使用 ngx.log（level, output info）
ngx.STDERR
ngx.EMERG
ngx.ALERT
ngx.CRIT
ngx.ERR
ngx.WARN
ngx.NOTICE
ngx.INFO
ngx.DEBUG
本次请求发起子请求 ngx.location.capture
local res = ngx.location.capture('/foo/bar?a=3&b=4')
// 子请求响应码不等于200
if res.status ~= 200 then
ngx.log(ngx.ERR, "sub request returned bad status: ",
res.status)
//父请求返回非200，整个请求结束
ngx.exit(res.status)
end
读写当前请求的响应码 ngx.status
上下文使用Lua时序方法set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*
//在Lua中使用当前请求响应码
local status = ngx.status
设置请求的响应头 ngx.header.HEADER
注意这个是响应头 response header
//注意在lua字符串中 \" 代表一个双引号符号，\' 代表一个单引号(撇号)字符
ngx.header["www-authenticate"] ="Bearer realm=\"http://xxx.paic.com.cn:8443/service/token\",service=\"harbor-registry\""
得到响应的所有头 ngx.resp.get_headers
上下文Lua时序方法 set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*, balancer_by_lua*
if ngx.status == 401 then
local h = ngx.resp.get_headers()
for k, v in pairs(h) do
if k == "www-authenticate" then
ngx.header["www-authenticate"] = "Bearer realm=12121"
end
end
end
local value = ngx.resp.get_headers()["header name"]
得到请求的所有头 ngx.req.get_headers
上下文lua时序方法set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*
local h = ngx.req.get_headers()
for k, v in pairs(h) do
if k == "authorization" then
ngx.req_set_header("authorization", "basic 1233")
end
end
local value = ngx.req.get_headers()["authorization"]
设置请求头信息 ngx.req.set_header
上下文Lua时序方法set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*
ngx.req_set_header("authorization", "basic 1233")
上传文件nginx报http 413错误
报413错误原因是请求实体太大，nginx的缓存区设置的太小，
http {
// 允许用户最大上传数据限制，默认1M，位置可放在http,server,location
client_max_body_size 500M;
client_body_filter_size 200M;
}
nginx中文日志乱码
nginx配置文件log_format增加 escape参数，json或者none都可以。
log_format main escape=json '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
参考
openresty官方
openresty实战：概念和应用场景
浅析openresty
openrestry相关lua解释
lua简单教程
nginx 401处理