Nginx通过配置请求参数限制接口地址访问方案

1. 访问需求

请求地址如下：
https://转发域名或ip:63333/api/subscribe/proxy/lecshi?accesskey=lmzfproxyforward_leshi&env=cloud-proxy-dev
https://转发域名或ip:63333/api/subscribe/proxy/lecshi?accesskey=lmzfproxyforward_leshi&env=cloud-proxy-test

nginx代理层要检查请求参数accesskey是以开头lmzfproxyforward_，且要有env标识，proxy_pass才转发给backend。
如果env是cloud-proxy-dev就是https://cloud-proxy-dev.lmzf.com//interface/imou
如果env是cloud-proxy-test就是https://cloud-proxy-test.lmzf.com/interface/imou

2. Nginx配置

# 在http块或server块中添加 resolver 8.8.8.8 114.114.114.114 223.5.5.5 valid=30s; resolver_timeout 5s; map $arg_env $backend_url { cloud-proxy-dev "https://cloud-proxy-dev.lmzf.com/interface/imou/"; cloud-proxy-test "https://cloud-proxy-test.lmzf.com/interface/imou/"; default ""; } map $arg_env $backend_host { cloud-proxy-dev "cloud-proxy-dev.lmzf.com"; cloud-proxy-test "cloud-proxy-test.lmzf.com"; default ""; } map $arg_accesskey $accesskey_valid { "~^lmzfproxyforward_" 1; default 0; } server { listen 63333; # 如果需要HTTPS支持 # listen 63333 ssl; # ssl_certificate /etc/nginx/ssl/lmzf.com.pem; # ssl_certificate_key /etc/nginx/ssl/lmzf.com.key; # DNS解析器（重要！） resolver 8.8.8.8 114.114.114.114 valid=30s; resolver_timeout 5s; location /api/subscribe/proxy/leshi { if ($args ~* "(.*)&(.*)") { set $args $1&$2; rewrite ^ /api/subscribe/proxy/leshi?$args break; } # 参数检查... if ($arg_accesskey = "") { return 403 "Missing accesskey"; } if ($accesskey_valid = 0) { return 403 "Invalid accesskey format"; } if ($arg_env = "") { return 403 "Missing env parameter"; } if ($backend_url = "") { return 403 "Invalid env value"; } # 设置正确的代理头 proxy_set_header Host $backend_host; # 使用后端主机名 proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; # 对于HTTPS后端，可能需要这些设置 proxy_ssl_server_name on; proxy_ssl_name $backend_host; # 如果后端是自签名证书，可以关闭验证（测试环境） proxy_ssl_verify off; # 代理到后端 proxy_pass $backend_url; # 添加一些调试头 add_header X-Backend-URL $backend_url; add_header X-Backend-Host $backend_host; } location / { return 403; } access_log /var/log/proxy_access.log; error_log /var/log/proxy_error.log; }

3. 测试验证

3.1 直接访问转发域名

[root@monitor conf.d]# curl https://cloud-proxy-dev.lmzf.com/interface/imou/ {"code":1099000001,"msg":"internal server error!","data":null}

3.2 访问代理地址

[root@monitor conf.d]# curl "http://服务器IP:63333/api/subscribe/proxy/leshi?accesskey=lmzfproxyforward_leshi&env=cloud-proxy-dev" {"code":1099000001,"msg":"internal server error!","data":null}

访问结果一致，配置成功。