node.js – nginx反向代理设置在执行CORS请求时不保留会话ID

这是我的设置：
– 我在nodejs中实现了一个公开api端点的http服务器.这是通过nginx反向代理到带有ssl的api.domain.com.这是配置：

 1 server {                                                           
 2     listen 80;                                                      
 3     server_name api.domain.com;                                     
 4     access_log /var/log/nginx/api.access.log;                       
 5     location / {                                                    
 6         proxy_pass    http://127.0.0.1:3000/;                       
 7     }                                                               
 8 }                                                                   
 9                                                                     
 10 server {                                                           
 11     listen 443;                                                    
 12     server_name api.domain.com;                                    
 13     access_log /var/log/nginx/api.access.log;                      
 14     ssl on;                                                        
 15     ssl_certificate /path/to/ssl/server.crt;     
 16     ssl_certificate_key /path/to/ssl/server.key;         
 17     location / {
 18         proxy_pass    https://127.0.0.1:3001/;                                
 19     }                                                              
 20 }

然后我让nginx在dashboard.domain.com下提供一个静态上下文文件,该文件旨在使用来自api.domain.com的api.这是设置：

  1 server {                                                                                                                                 
  2     listen 80;                                                                  
  3     server_name dashboard.domain.com;                                        
  4     root /path/to/static/site;                                                                                             
  5 }  

我想用CORS做这个,我确保静态站点上的js在所有请求中发送正确的Origin头.我实现了一个非常简单的登录机制.这是我在api端点上使用的coffeescript代码：

# server.coffee
app.configure ->
    app.use middleware.setP3PHeader()
    app.use express.bodyParser()
    app.use express.cookieParser()
    app.use express.session
      secret: conf.session.secret
      key: conf.session.key
      cookie:
          maxAge: conf.session.maxAge
    app.use express.methodOverride()
    app.use express.query()
    app.use express.errorHandler()

# routes.coffee
app.options '*', shop.cors, shop.options
app.post '/login', shop.cors, shop.login
app.post '/logout', shop.cors, shop.logout
app.get '/current-user', shop.cors, shop.current

# shop.coffee
exports.options = (req, res) ->
    res.send 200

exports.cors = (req, res, next) ->
    allowed = ['http://dashboard.domain.com', 'http://localhost:3000']
    origin = req.get 'Origin'
    if origin? and origin in allowed
        res.set 'Access-Control-Allow-Origin', origin
        res.set 'Access-Control-Allow-Credentials', true
        res.set 'Access-Control-Allow-Methods', 'GET,POST'
        res.set 'Access-Control-Allow-Headers', 'X-Requested-With, Content-Type'
        next()
    else
        res.send 403, "Not allowed for #{origin}"

exports.login = (req, res) ->
    unless req.body.email? and req.body.password?
        res.send 400, "Request params not correct #{req.body}"
    models.Shop.findOne()
        .where('email').equals(req.body.email)
        .where('password').equals(req.body.password)
        .exec (err, shop) ->
            if err? then return res.send 500, err.message
            unless shop? then return res.send 401, "Not found for #{req.body}"

            req.session.shopId = shop.id
            res.send 200, shop.publish()

exports.logout = (req, res) ->
    delete req.session.shopId
    res.send 200

exports.current = (req, res) ->
    unless req.session.shopId?
        return res.send 401, "Not logged in!"
    models.Shop.findById(req.session.shopId)
        .exec (err, shop) ->
            if err? then return send.res 500, err.message
            unless shop? then return res.send 404, "No shop for #{req.session.shopId}"

            res.send 200, shop.publish()

问题是这样的：
1.我首先打电话给/ login,然后我与登录用户进行了一次新会话(req.session.shopId)
然后我打电话给/当前用户,但会话已经消失了！ nodejs服务器收到的会话ID不同,因此会创建不同的会话

解决方法:

看起来你有一个全局代理指令(proxy_pass),但你没有明确地处理头转发(其中,可能是会话令牌作为cookie存在),而且你需要考虑什么构成(共享)会话缓存键.

可能会尝试这样的事情：

location / {
   proxy_pass  http://127.0.0.1:3000/;                                
   proxy_redirect off;
   proxy_set_header   X-Real-IP  $remote_addr;
   proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
   proxy_set_header   X-Forwarded-Proto  $scheme;
   proxy_set_header   Host  $http_host;
   proxy_set_header   X-NginX-Proxy  true;
   proxy_http_version 1.1;
   proxy_cache pcache;
   proxy_cache_key   "$scheme$host$request_method$request_uri";
}

此外,如果node.js服务器位于同一个框中,则不确定为什么要通过localhost上的ssl进行连接(proxy_pass https://127.0.0.1:3001/).您可能希望通过执行以下操作来考虑使用重写指令公开仅限SSL的公共面：rewrite ^ https：//api.domain.com$request_uri？常驻;

另请参阅：基本设置上的Node.js + Nginx – What now? [SO],以及来自nginx反向代理配置snafu的丢失(和更糟糕 – 泄漏！)会话的良好讨论的http://www.ruby-forum.com/topic/4408747.

标签：nginx,node-js,cors,express,reverse-proxy
来源： https://codeday.me/bug/20190831/1779016.html