为什么我在 Rails 应用程序中使用 force_ssl 获得无限重定向循环?

问题描述：

我想让我的 API 控制器使用 SSL，所以我在我的 nginx.conf 中添加了另一个监听指令

I want to have my API controller use SSL, so I added another listen directive to my nginx.conf

upstream unicorn {
  server unix:/tmp/unicorn.foo.sock fail_timeout=0;
}

server {
  listen 80 default deferred;
  listen 443 ssl default;
  ssl_certificate /etc/ssl/certs/foo.crt;
  ssl_certificate_key /etc/ssl/private/foo.key;

  server_name foo;
  root /var/apps/foo/current/public;

  try_files $uri/system/maintenance.html $uri/index.html $uri @unicorn;

  location @unicorn {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_pass http://unicorn;
  }

  error_page 502 503 /maintenance.html;
  error_page 500 504 /500.html;
  keepalive_timeout 5;
}

通过 nginx conftest 没有任何问题.我还在 ApiController

which passes the nginx conftest without any problems. I also added a force_ssl directive to my ApiController

class ApiController < ApplicationController
  force_ssl if Rails.env.production?

  def auth
    user = User.authenticate(params[:username], params[:password])
    respond_to do |format|
      format.json do
        if user
          user.generate_api_key! unless user.api_key.present?
          render json: { key: user.api_key }
        else
          render json: { error: 401 }, status: 401
        end
      end
    end
  end

  def check
    user = User.find_by_api_key(params[:api_key])
    respond_to do |format|
      format.json do
        if user
          render json: { status: 'ok' }
        else
          render json: { status: 'failure' }, status: 401
        end
      end
    end
  end
end

当我不使用 SSL 时效果很好，但是现在当我尝试 curl --LI http://foo/api/auth.json 时，我被正确重定向到 https，但后来我一直被重定向到 http://foo/api/auth 以无限重定向循环结束.

which worked just fine when I wasn't using SSL, but now when I try to curl --LI http://foo/api/auth.json, I get properly redirected to https, but then I keep on getting redirected to http://foo/api/auth ending in an infinite redirect loop.

我的路线只有

get "api/auth"
get "api/check"

我在 Ruby 1.9.2 和 nginx 0.7.65 上使用 Rails 3.2.1

I'm using Rails 3.2.1 on Ruby 1.9.2 with nginx 0.7.65

答

您没有转发有关此请求是否为 HTTPS 终止请求的任何信息.通常，在服务器中，ssl on;"指令将设置这些标题，但您使用的是组合块.

You're not forwarding any information about whether this request was an HTTPS-terminated request or not. Normally, in a server, the "ssl on;" directive will set these headers, but you're using a combined block.

Rack(和 force_ssl)通过以下方式确定 SSL:

Rack (and force_ssl) determines SSL by:

如果请求来自 443 端口(这可能不会从 nginx 传递回 Unicorn)
如果 ENV['HTTPS'] == "on"
如果 X-Forwarded-Proto 标头 == "HTTPS"

请参阅force_ssl 来源了解完整故事.

由于您使用的是组合块，因此您想使用第三种形式.试试:

Since you're using a combined block, you want to use the third form. Try:

proxy_set_header X-Forwarded-Proto $scheme;

在您的服务器或位置块中根据 nginx 文档.

in your server or location block per the nginx documentation.

这将在您收到 80 端口请求时将标头设置为http"，并在您收到 443 请求时将其设置为https".

This will set the header to "http" when you come in on a port 80 request, and set it to "https" when you come in on a 443 request.

为什么我在 Rails 应用程序中使用 force_ssl 获得无限重定向循环?

相关推荐