官方限流组件在反向代理的情况下有问题

solo123

环境

centos7,webman1.6,在本地使用openresty做反向代理.
http://本地域名:8080 反向到 192.168.31.11:8787

<?php

namespace app\middleware;
use Webman\Http\Request;
use Webman\Http\Response;
use Webman\MiddlewareInterface;
use Webman\RateLimiter\Limiter;
class LimiterMiddleware implements MiddlewareInterface {

    public function process(Request $request, callable $handler): Response {
        var_dump($request->getRealIp()); // 固定值,没问题
        Limiter::check($request->getRealIp(), 3, 15, '限流了');
        $response = $handler($request);
        return $response;
    }
}

这段代码再不使用反向代理情况下,非常正常.使用了反向代理后,最少有3分之2的请求拦截不了,也就是说无法触发限流.

这是我的nginx配置

location ^~ / {
    proxy_pass http://192.168.31.11:8787; 
    proxy_set_header Host $host; 
    proxy_set_header X-Real-IP $remote_addr; 
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; 
    proxy_set_header REMOTE-HOST $remote_addr; 
    proxy_set_header Upgrade $http_upgrade; 
    proxy_set_header Connection $http_connection; 
    proxy_set_header X-Forwarded-Proto $scheme; 
    proxy_http_version 1.1; 
    add_header X-Cache $upstream_cache_status; 
    add_header Cache-Control no-cache; 
    proxy_ssl_server_name off; 
    proxy_ssl_name $proxy_host; 
}
167 1 0
1个回答

按照文档配置 https://www.workerman.net/doc/webman/others/nginx-proxy.html

# 客户端可以伪造ip
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

改成

# 客户端无法伪造ip
proxy_set_header X-Forwarded-For $remote_addr;
  • solo123 3天前

    确实是我的问题,是我没有配置好,感谢大佬
    已打赏,略表心意

    这个打赏,被风控了,无法支付了

×
🔝