1
Lockeysama 2020-10-12 15:23:00 +08:00
还是看访问日志吧
|
2
engineercj 2020-10-12 15:25:55 +08:00
user root;
|
3
whorusq 2020-10-12 15:39:12 +08:00
ssl on;
|
4
bruce0 2020-10-12 15:41:38 +08:00
把错误 log 打开.看一下错误 log 这样最容易找到问题
|
5
zunceng 2020-10-12 16:05:00 +08:00
443 和 80 的 配置都不一样
Upgrade ? websocket ? |
6
simenet 2020-10-12 16:08:58 +08:00
目录 权限不够
|
7
guanyujia5444 OP @Lockeysama 访问日志无任何报错,也就是说 nginx 正常转发了,但使用证书方式转发时候,后端应用拒绝了,不知道是不是应该在 nginx 配置文件上添加参数
|
8
guanyujia5444 OP @engineercj 不是这个问题,如果是这个问题,影响是全局的,不会 80 端口正常,443 不正常
|
9
guanyujia5444 OP @whorusq ssl on 的方式,已经淘汰了,现在都是这么用
listen 443 ssl; |
10
Citrus 2020-10-12 16:39:59 +08:00
proxy_set_header Host $http_host;
ssl 段没把 host 传过去啊 |
11
guanyujia5444 OP @zunceng 配置是有些不一样,我把 timeout 和 buffer 补上试试
|
12
guanyujia5444 OP @simenet 不是这个问题,这个是反向代理,不是作为本地 web 服务器
|
13
guanyujia5444 OP @Citrus 因为之前解决问题,有人说需要注释掉这条。。。我先补上
下面这两条意义一致吗? # proxy_set_header Host $host:$server_port; # proxy_set_header Host $proxy_host; |
14
ctOS1H 2020-10-12 16:49:45 +08:00
日志
|
15
oliverchen 2020-10-12 16:51:16 +08:00
是上游根据 HOST “不合法”返回的 403 吧。试试在 ssl server 那块,也加上 `proxy_set_header Host $http_host;` 或者 `proxy_set_header Host $host;`
|
16
zunceng 2020-10-12 17:06:33 +08:00
@guanyujia5444 你把 websocket 的配置 删掉试试 就是 Upgrade 相关的
|
17
guanyujia5444 OP @zunceng 这块不太懂,是删掉如下几条吗?
proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Upgrade-Insecure-Requests 1; |
18
guanyujia5444 OP @zunceng 已经注释掉这三条,还是不行的
|
19
guanyujia5444 OP 最新的配置如下,依然是 http 的 81 可以访问,https 的 8888 端口无法访问,两个转发的后端服务都是一样的。
转发的协议是 http 的。 #user nobody; worker_processes 1; error_log logs/error.log; error_log logs/error.log notice; error_log logs/error.log info; #pid logs/nginx.pid; events { worker_connections 1024; } http { include mime.types; default_type application/octet-stream; #log_format main '$remote_addr - $remote_user [$time_local] "$request" ' # '$status $body_bytes_sent "$http_referer" ' # '"$http_user_agent" "$http_x_forwarded_for"'; #access_log logs/access.log main; sendfile on; tcp_nopush on; #keepalive_timeout 0; keepalive_timeout 65; gzip on; upstream ncc{ ip_hash; server 192.168.100.241:9081 weight=10; server 192.168.100.241:9082 weight=10; keepalive 300; } server { listen 81; server_name localhost; index index.jsp; location / { allow all; index index.jsp index.html; proxy_pass http://ncc; proxy_set_header Host $http_host; proxy_set_header Cookie $http_cookie; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; client_max_body_size 100m; client_body_buffer_size 256k; proxy_buffering off; proxy_connect_timeout 1; proxy_send_timeout 30; proxy_read_timeout 60; proxy_buffer_size 256k; proxy_buffers 4 256k; proxy_busy_buffers_size 256k; proxy_temp_file_write_size 256k; proxy_max_temp_file_size 128m; } } server { listen 8888 ssl; #error_page 497 301 =307 https://$host:443$request_uri; server_name localhost; index index.jsp; ssl_certificate cert/2.pem; ssl_certificate_key cert/2.key; ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on; location / { allow all; index index.jsp index.html; proxy_pass http://ncc; proxy_set_header X-Real-IP $remote_addr; proxy_set_header Host $http_host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_set_header Cookie $http_cookie; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header Upgrade-Insecure-Requests 1; client_max_body_size 100m; client_body_buffer_size 256k; proxy_buffering off; proxy_connect_timeout 1; proxy_send_timeout 30; proxy_read_timeout 60; proxy_buffer_size 256k; proxy_buffers 4 256k; proxy_busy_buffers_size 256k; proxy_temp_file_write_size 256k; proxy_max_temp_file_size 128m; } } } |
20
xuanbg 2020-10-12 17:14:36 +08:00
加这几句:
set $ssl off; if ($scheme = https) { set $ssl on; } |
21
guanyujia5444 OP 访问的时候,没有任何相关错误日志,我认为是转发成功了,但后端服务拒绝了。
为啥 http 就正常访问,https 就被后端服务拒绝,这个地方有些疑问。 另外试了下,apache 使用 ajp 或者 http 反向代理转发都可行 |
22
guanyujia5444 OP @xuanbg 是加在那个标签中? http {}吗?
|
23
xuanbg 2020-10-12 17:23:54 +08:00
@guanyujia5444
server { listen 443 ssl; server_name api.i-facture.com; ssl_certificate /opt/cert/api.i-facture.com.pem; ssl_certificate_key /opt/cert/api.i-facture.com.key; ssl_session_timeout 5m; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; ssl_prefer_server_ciphers on; set $ssl off; if ($scheme = https) { set $ssl on; } …… } |
24
guanyujia5444 OP @xuanbg 谢谢,我试试
|
25
guanyujia5444 OP @xuanbg 还是不行
|
26
tuxz 2020-10-12 18:09:17 +08:00 via Android
贴下 access log
|
27
guanyujia5444 OP https://hr.xxxx.com.cn:8888/
这个是 https 的 access 日志 看着没有啥问题 192.168.100.210 - - [12/Oct/2020:17:10:35 +0800] "POST /nccloud/riart/login/init.do HTTP/1.1" 200 700 "http://192.168.100.225:81/nccloud/resources/uap/rbac/login/main/index.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:10:35 +0800] "GET /nccloud/resources/uap/public/img/picture.ico HTTP/1.1" 200 9662 "http://192.168.100.225:81/nccloud/resources/uap/rbac/login/main/index.html" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:10:36 +0800] "GET /nccloud/ HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:10:37 +0800] "GET /nccloud/ HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:10:38 +0800] "GET /nccloud/ HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:10:38 +0800] "GET /nccloud/ HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:10:38 +0800] "GET /nccloud/ HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:10:39 +0800] "GET /nccloud/ HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:10:39 +0800] "GET /nccloud/ HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:58:19 +0800] "GET /nccloud HTTP/1.1" 302 5 "https://hr.xxxx.com.cn:8888/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:58:19 +0800] "GET /nccloud/ HTTP/1.1" 400 657 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:58:20 +0800] "GET /favicon.ico HTTP/1.1" 400 657 "http://hr.xxxx.com.cn:8888/nccloud/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:58:33 +0800] "GET /nccloud/ HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:17:58:35 +0800] "GET /nccloud/ HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" 192.168.100.210 - - [12/Oct/2020:18:06:18 +0800] "GET /nccloud/ HTTP/1.1" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36 Edg/86.0.622.38" |
28
dudu2017 2020-10-12 18:29:53 +08:00 via iPhone
建议开启 debug 日志看
error_log /path/to/log debug; |
29
masker 2020-10-12 18:32:57 +08:00 via Android
那就看上游的日志啊
|
30
yongliu 2020-10-12 19:22:21 +08:00
access 日志可以看到反向代理这边应该是过了
看看后端为啥返回 403 吧 |
31
tsanie 2020-10-12 19:35:46 +08:00 1
说个题外话,其实我比较好奇已经采用 listen 443 ssl;方式监听了。为什么不把 http/https 写到同一个 server 中(如果 server_name 相同,要提供的内容又是一样的话)
server { listen 80; listen 443 ssl; ... } |
32
xuanbg 2020-10-12 21:17:04 +08:00
@guanyujia5444 你的证书是指定的 localhost ?
|
33
dany813 2020-10-13 09:36:06 +08:00
最后解决了吗
|
34
guanyujia5444 OP @yongliu 我也觉得是过了,应该是后端的问题,但后端为啥拒绝就不知道了,有啥能和 nginx 冲突的吗? apache 正常的
|
35
guanyujia5444 OP @xuanbg 指定的网址,我也通过网址访问的,应该是 nginx 已经转发了,但后端拒绝了
|
36
guanyujia5444 OP @dany813 没有解决,我慢慢调试吧
|
37
guanyujia5444 OP @tsanie 其实可以写一个里面,主要是为了调试方便,便于排查问题。
|
38
guanyujia5444 OP 谢谢大家的帮助,我这边已经肯定是 nginx 已经成功转发了,但后端拒绝了证书的访问,同样的反向代理 apache 就正常,这是奇怪的点。
|
39
yongliu 2020-10-13 14:49:01 +08:00
@guanyujia5444 #34 后端没有日志打印吗?
|
40
Acoffice 2020-10-14 10:54:55 +08:00
也可能是 nginx 本身的问题,换个 nginx 版本试试.
|
41
whorusq 2020-10-14 17:30:59 +08:00
@guanyujia5444 看来我的 nginx 版本该升级一波了
|
42
whorusq 2020-10-14 17:36:33 +08:00
403 这个错误提示是权限问题应该没什么争议,我觉得还是从各方面的权限检查一遍,包括各级文件、文件夹、相关用户等
之前遇到过子级目录看着权限一点问题没有,但是父级目录却没权限,导致同样提示 403 的问题,也折腾很长时间 |
43
throns 2020-11-04 18:06:16 +08:00
我刚遇到了这个问题。我这边的情况是,nginx 服务反向代理 k8s (用了 nginx ingress ) 的服务,同样是 http 正常访问,https 的 get 请求也正常访问,但 https 的 post 请求失败,只报了 403,没有别的错误提示,我后来测了一下,用 postman 可以正常调用 post 请求,但浏览器调用失败,隐约觉得是跨域的问题,后来发现真的是,后端( gin ) AllowOrigins 只允许了 http,没有允许 https,后端加上之后就可以了,只是不知道为什么只报了 403,没有报跨域的提示。不知道是不是 gin-contrib/cors 的问题,还是整个链路比较长导致的问题。
|
44
program9527 2021-09-16 23:25:11 +08:00
给后面看到这个问题的人,如果你遇到同样的问题。请在 Nginx 的 http {} 或者 server{} 块中,添加如下配置:
# 这一行如果不设置,对于某些 https 会出现报错 proxy_ssl_server_name on; |