FastApi记录客户端访问IP非真实客户端请求IP问题

FastApi记录客户端访问IP非真实客户端请求IP问题

作者：lizhonglin
github: https://github.com/Leezhonglin/
blog: https://leezhonglin.github.io

最近开发的项目需要记录客户的操作日志，通过FastApi添加自定义日志中间件后。使用docker部署后，记录客户端访问的IP，获取到的客户端IP是docker容器内部的一个IP地址，无法获取到真实请求的IP地址。搜索了很多发现说的都是修改什么防火墙设置之类的问题。我使用docker部署根本都没有启动什么防火墙。感觉不怎么靠谱。查看了Uvicorn官方部署文档Deployment中有详细的介绍。其中关键的段落

Running behind Nginx¶
Using Nginx as a proxy in front of your Uvicorn processes may not be neccessary, but is recommended for additional resiliance. Nginx can deal with serving your static media and buffering slow requests, leaving your application servers free from load as much as possible.

In managed environments such as Heroku, you wont typically need to configure Nginx, as your server processes will already be running behind load balancing proxies.

The recommended configuration for proxying from Nginx is to use a UNIX domain socket between Nginx and whatever the process manager that is being used to run Uvicorn. Note that when doing this you will need run Uvicorn with --forwarded-allow-ips='*' to ensure that the domain socket is trusted as a source from which to proxy headers.

When fronting the application with a proxy server you want to make sure that the proxy sets headers to ensure that application can properly determine the client address of the incoming connection, and if the connection was over http or https.

You should ensure that the X-Forwarded-For and X-Forwarded-Proto headers are set by the proxy, and that Uvicorn is run using the --proxy-headers setting. This ensure that the ASGI scope includes correct client and scheme information.

Here's how a simple Nginx configuration might look. This example includes setting proxy headers, and using a UNIX domain socket to communicate with the application server.

It also includes some basic configuration to forward websocket connections. For more info on this, check Nginx recommendations.


http {
  server {
    listen 80;
    client_max_body_size 4G;

    server_name example.com;

    location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;
      proxy_redirect off;
      proxy_buffering off;
      proxy_pass http://uvicorn;
    }

    location /static {
      # path for static files
      root /path/to/app/static;
    }
  }

  map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
  }

  upstream uvicorn {
    server unix:/tmp/uvicorn.sock;
  }

}
Uvicorn's --proxy-headers behavior may not be sufficient for more complex proxy configurations that use different combinations of headers, or where the application is running behind more than one intermediary proxying service.

In those cases you might want to use an ASGI middleware to set the client and scheme dependant on the request headers.

因此解决这个问题在我们部署环境中添加对应的参数，就可以获取到真正用户的请求IP地址,项目启动命令如下配置：

gunicorn main:app -b 0.0.0.0:10022 -w 4 -k uvicorn.workers.UvicornWorker --timeout 0 --access-logfile -

问题瞬间解决了，记录一下解决问题的过程，方便下次学习。

附：官方链接