Nginx通过配置请求参数限制接口地址访问方案

原创于 2025-12-23 09:28:41 发布 · 83 阅读

CC 4.0 BY-SA版权

文章标签：

1. 访问需求

请求地址如下：
https://转发域名或ip:63333/api/subscribe/proxy/lecshi?accesskey=lmzfproxyforward_leshi&env=cloud-proxy-dev
https://转发域名或ip:63333/api/subscribe/proxy/lecshi?accesskey=lmzfproxyforward_leshi&env=cloud-proxy-test

nginx代理层要检查请求参数accesskey是以开头lmzfproxyforward_，且要有env标识，proxy_pass才转发给backend。
如果env是cloud-proxy-dev就是https://cloud-proxy-dev.lmzf.com//interface/imou
如果env是cloud-proxy-test就是https://cloud-proxy-test.lmzf.com/interface/imou

2. Nginx配置

# 在http块或server块中添加
resolver 8.8.8.8 114.114.114.114 223.5.5.5 valid=30s;
resolver_timeout 5s;

map $arg_env $backend_url {
    cloud-proxy-dev  "https://cloud-proxy-dev.lmzf.com/interface/imou/";
    cloud-proxy-test "https://cloud-proxy-test.lmzf.com/interface/imou/";
    default          "";
}

map $arg_env $backend_host {
    cloud-proxy-dev  "cloud-proxy-dev.lmzf.com";
    cloud-proxy-test "cloud-proxy-test.lmzf.com";
    default          "";
}

map $arg_accesskey $accesskey_valid {
    "~^lmzfproxyforward_" 1;
    default                0;
}

server {
    listen 63333;

    # 如果需要HTTPS支持
    # listen 63333 ssl;
    # ssl_certificate    /etc/nginx/ssl/lmzf.com.pem;
    # ssl_certificate_key   /etc/nginx/ssl/lmzf.com.key;

    # DNS解析器（重要！）
    resolver 8.8.8.8 114.114.114.114 valid=30s;
    resolver_timeout 5s;

    location /api/subscribe/proxy/leshi {
        if ($args ~* "(.*)&amp;(.*)") {
            set $args $1&$2;
            rewrite ^ /api/subscribe/proxy/leshi?$args break;
        }

        # 参数检查...
        if ($arg_accesskey = "") {
            return 403 "Missing accesskey";
        }

        if ($accesskey_valid = 0) {
            return 403 "Invalid accesskey format";
        }

        if ($arg_env = "") {
            return 403 "Missing env parameter";
        }

        if ($backend_url = "") {
            return 403 "Invalid env value";
        }

        # 设置正确的代理头
        proxy_set_header Host $backend_host;  # 使用后端主机名
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 对于HTTPS后端，可能需要这些设置
        proxy_ssl_server_name on;
        proxy_ssl_name $backend_host;

        # 如果后端是自签名证书，可以关闭验证（测试环境）
        proxy_ssl_verify off;

        # 代理到后端
        proxy_pass $backend_url;

        # 添加一些调试头
        add_header X-Backend-URL $backend_url;
        add_header X-Backend-Host $backend_host;
    }

    location / {
        return 403;
    }

    access_log /var/log/proxy_access.log;
    error_log /var/log/proxy_error.log;
}

3. 测试验证

3.1 直接访问转发域名

[root@monitor conf.d]# curl  https://cloud-proxy-dev.lmzf.com/interface/imou/
{"code":1099000001,"msg":"internal server error!","data":null}

3.2 访问代理地址

[root@monitor conf.d]# curl   "http://服务器IP:63333/api/subscribe/proxy/leshi?accesskey=lmzfproxyforward_leshi&env=cloud-proxy-dev"
{"code":1099000001,"msg":"internal server error!","data":null}

访问结果一致，配置成功。