一、 架构设计与请求流转核心流程图客户端(浏览器)│ ▼(1. 请求受保护资源 /secure/data.pdf 或 /api/user/info)┌─────────────────────────────────────────────────────┐ │ Nginx(反向代理静态资源服务器)│ │ ├─(2)拦截请求发起内部子请求(auth_request)│ │ │ └─转发至 /_auth(携带 Cookie/Token, 原始URI)│ │ │ │ │ ├─(3)接收 Spring Boot 鉴权结果 │ │ │ ├─200OK: 提取用户信息放行请求 │ │ │ ├─401Unauthorized: 重定向到登录页或返回401 │ │ │ └─403Forbidden: 返回无权限页面 │ │ │ │ │ └─(4)鉴权通过将请求转发给后端业务服务或返回静态文件│ └─────────────────────────────────────────────────────┘ │ ▼ ┌─────────────────────────┐ ┌─────────────────────────┐ │ Spring Boot(鉴权服务)│ │ Spring Boot(业务服务)│ │ - 校验 Token/JWT │ │ - 直接读取 Nginx 传来的 │ │ - 校验 URL/RBAC 权限 │ │ X-User-Id 等 Header │ │ - 返回200/401/403 │ │ - 无需再解析 Token │ └─────────────────────────┘ └─────────────────────────┘二、 Nginx 生产级配置在生产环境中Nginx 配置需要处理凭证传递、原始 URI 传递、错误重定向、以及跨域预检OPTIONS放行。. --with-http_auth_request_module 添加auth模块# 定义上游服务upstream auth_backend{server127.0.0.1:8080;# Spring Boot 鉴权服务keepalive64;# 生产环境必须开启长连接降低子请求延迟}upstream biz_backend{server127.0.0.1:8081;# Spring Boot 业务服务keepalive64;}server{listen443ssl http2;server_name example.com;# --- 生产环境安全基础配置 ---ssl_certificate /etc/nginx/ssl/example.com.crt;ssl_certificate_key /etc/nginx/ssl/example.com.key;ssl_protocols TLSv1.2 TLSv1.3;add_header X-Frame-OptionsSAMEORIGINalways;add_header X-Content-Type-Optionsnosniffalways;# 1. 公开资源 (登录页、静态JS/CSS/图片等不走鉴权)location /public/{root /var/www/html;expires 7d;# 强缓存}# 2. 受保护的前端页面或静态资源 (如内部报表、敏感文档)location /secure/{# 开启鉴权子请求auth_request /_auth;# 鉴权失败处理error_page401/public/login.html;# 未登录重定向到登录页error_page403/public/403.html;# 无权限提示页# 【关键】将鉴权子请求返回的用户信息注入到转发给后端的 Header 中auth_request_set$user_id$upstream_http_x_user_id;auth_request_set$user_role$upstream_http_x_user_role;# 如果是代理到后端业务服务传递用户信息proxy_set_header X-User-Id$user_id;proxy_set_header X-User-Role$user_role;# 如果是直接返回静态文件则不需要 proxy_passalias/var/www/secure_files/;}# 3. 受保护的 API 接口location /api/{auth_request /_auth;auth_request_set$user_id$upstream_http_x_user_id;proxy_set_header X-User-Id$user_id;proxy_pass http://biz_backend;}# 4. 核心鉴权子请求接口 (内部隐藏)location/_auth{internal;# 禁止外部直接访问此路径proxy_pass http://auth_backend/api/auth/check;# 生产环境性能优化不传递 Body只传 Headerproxy_pass_request_body off;proxy_set_header Content-Length;# 传递客户端真实 IPproxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# 【关键】传递原始请求的 URI 和 Method供 Spring Boot 做细粒度 RBAC 校验proxy_set_header X-Original-URI$request_uri;proxy_set_header X-Original-Method$request_method;# 【关键】传递鉴权凭证 (Cookie 或 Authorization Header)proxy_set_header Cookie$http_cookie;proxy_set_header Authorization$http_authorization;# 保持长连接proxy_http_version1.1;proxy_set_header Connection;}}三、 生产级案例在生产环境中对私有资源认证。server{listen1443ssl;server_name localhost;ssl_certificate../ssl/chat.crt;ssl_certificate_key../ssl/chat.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location/_auth{internal;proxy_pass http://127.0.0.1:8080/auth/check;proxy_pass_request_body off;proxy_set_header Content-Length;proxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;proxy_set_header X-Original-URI$request_uri;proxy_set_header X-Original-Method$request_method;proxy_set_header Cookie$http_cookie;proxy_set_header Authorization$http_authorization;proxy_set_header Token$http_token;proxy_http_version1.1;proxy_set_header Connection;}location /public{root html;index index.html index.htm;}location /private{set$main_args$args;auth_request /_auth;error_page401/public/index_401.html;error_page403/public/index_403.html;auth_request_set$user_id$upstream_http_x_user_id;auth_request_set$user_role$upstream_http_x_user_role;proxy_set_header X-User-Id$user_id;proxy_set_header X-User-Role$user_role;root html;index index.html index.htm;}}鉴权实现。packagecom.app.sso.user;importcom.app.sso.component.RequestUtil;importlombok.extern.slf4j.Slf4j;importorg.apache.commons.lang3.StringUtils;importorg.springframework.web.bind.annotation.GetMapping;importorg.springframework.web.bind.annotation.RequestMapping;importorg.springframework.web.bind.annotation.RestController;importorg.springframework.web.util.UriComponents;importorg.springframework.web.util.UriComponentsBuilder;importjavax.annotation.Resource;importjavax.servlet.http.HttpServletRequest;importjavax.servlet.http.HttpServletResponse;importjava.util.Enumeration;importjava.util.HashMap;importjava.util.Map;/** * author wym13 */Slf4jRestControllerRequestMapping(/auth)publicclassUserAuthController{ResourceprivateRequestUtilrequestUtil;privatestaticfinalStringMSG_MISSING_TOKEN未携带token;privatestaticfinalStringMSG_AUTH_SUCCESS认证成功;privatestaticfinalStringMSG_INVALID_TOKEN无权访问;GetMapping(/check)publicMapString,Objectauth(HttpServletRequestrequest,HttpServletResponseresponse){HashMapString,ObjectresultnewHashMap(2);Stringtokenrequest.getHeader(token);if(StringUtils.isBlank(token)){StringoriginalUrirequest.getHeader(X-Original-URI);if(StringUtils.isNotBlank(originalUri)){try{UriComponentscomponentsUriComponentsBuilder.fromUriString(http://dummyoriginalUri).build();tokencomponents.getQueryParams().getFirst(token);}finally{log.info(originalUri{},queryParamsToken{},originalUri,token);}}}if(StringUtils.isBlank(token)){log.info(鉴权失败token为空, IP{}, URI{},getClientIp(request),request.getRequestURI());response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);result.put(code,HttpServletResponse.SC_UNAUTHORIZED);result.put(msg,MSG_MISSING_TOKEN);returnresult;}else{if(requestUtil.checkToken(token)){response.setStatus(HttpServletResponse.SC_OK);result.put(code,HttpServletResponse.SC_OK);result.put(msg,MSG_AUTH_SUCCESS);}else{response.setStatus(HttpServletResponse.SC_FORBIDDEN);result.put(code,HttpServletResponse.SC_FORBIDDEN);result.put(msg,MSG_INVALID_TOKEN);log.info(鉴权失败token无效, IP{},getClientIp(request));}}returnresult;}// 工具方法获取客户端IPprivateStringgetClientIp(HttpServletRequestrequest){Stringiprequest.getHeader(X-Forwarded-For);if(StringUtils.isBlank(ip)||unknown.equalsIgnoreCase(ip)){iprequest.getRemoteAddr();}returnip;}}
一、 架构设计与请求流转核心流程图客户端(浏览器)│ ▼(1. 请求受保护资源 /secure/data.pdf 或 /api/user/info)┌─────────────────────────────────────────────────────┐ │ Nginx(反向代理静态资源服务器)│ │ ├─(2)拦截请求发起内部子请求(auth_request)│ │ │ └─转发至 /_auth(携带 Cookie/Token, 原始URI)│ │ │ │ │ ├─(3)接收 Spring Boot 鉴权结果 │ │ │ ├─200OK: 提取用户信息放行请求 │ │ │ ├─401Unauthorized: 重定向到登录页或返回401 │ │ │ └─403Forbidden: 返回无权限页面 │ │ │ │ │ └─(4)鉴权通过将请求转发给后端业务服务或返回静态文件│ └─────────────────────────────────────────────────────┘ │ ▼ ┌─────────────────────────┐ ┌─────────────────────────┐ │ Spring Boot(鉴权服务)│ │ Spring Boot(业务服务)│ │ - 校验 Token/JWT │ │ - 直接读取 Nginx 传来的 │ │ - 校验 URL/RBAC 权限 │ │ X-User-Id 等 Header │ │ - 返回200/401/403 │ │ - 无需再解析 Token │ └─────────────────────────┘ └─────────────────────────┘二、 Nginx 生产级配置在生产环境中Nginx 配置需要处理凭证传递、原始 URI 传递、错误重定向、以及跨域预检OPTIONS放行。. --with-http_auth_request_module 添加auth模块# 定义上游服务upstream auth_backend{server127.0.0.1:8080;# Spring Boot 鉴权服务keepalive64;# 生产环境必须开启长连接降低子请求延迟}upstream biz_backend{server127.0.0.1:8081;# Spring Boot 业务服务keepalive64;}server{listen443ssl http2;server_name example.com;# --- 生产环境安全基础配置 ---ssl_certificate /etc/nginx/ssl/example.com.crt;ssl_certificate_key /etc/nginx/ssl/example.com.key;ssl_protocols TLSv1.2 TLSv1.3;add_header X-Frame-OptionsSAMEORIGINalways;add_header X-Content-Type-Optionsnosniffalways;# 1. 公开资源 (登录页、静态JS/CSS/图片等不走鉴权)location /public/{root /var/www/html;expires 7d;# 强缓存}# 2. 受保护的前端页面或静态资源 (如内部报表、敏感文档)location /secure/{# 开启鉴权子请求auth_request /_auth;# 鉴权失败处理error_page401/public/login.html;# 未登录重定向到登录页error_page403/public/403.html;# 无权限提示页# 【关键】将鉴权子请求返回的用户信息注入到转发给后端的 Header 中auth_request_set$user_id$upstream_http_x_user_id;auth_request_set$user_role$upstream_http_x_user_role;# 如果是代理到后端业务服务传递用户信息proxy_set_header X-User-Id$user_id;proxy_set_header X-User-Role$user_role;# 如果是直接返回静态文件则不需要 proxy_passalias/var/www/secure_files/;}# 3. 受保护的 API 接口location /api/{auth_request /_auth;auth_request_set$user_id$upstream_http_x_user_id;proxy_set_header X-User-Id$user_id;proxy_pass http://biz_backend;}# 4. 核心鉴权子请求接口 (内部隐藏)location/_auth{internal;# 禁止外部直接访问此路径proxy_pass http://auth_backend/api/auth/check;# 生产环境性能优化不传递 Body只传 Headerproxy_pass_request_body off;proxy_set_header Content-Length;# 传递客户端真实 IPproxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;# 【关键】传递原始请求的 URI 和 Method供 Spring Boot 做细粒度 RBAC 校验proxy_set_header X-Original-URI$request_uri;proxy_set_header X-Original-Method$request_method;# 【关键】传递鉴权凭证 (Cookie 或 Authorization Header)proxy_set_header Cookie$http_cookie;proxy_set_header Authorization$http_authorization;# 保持长连接proxy_http_version1.1;proxy_set_header Connection;}}三、 生产级案例在生产环境中对私有资源认证。server{listen1443ssl;server_name localhost;ssl_certificate../ssl/chat.crt;ssl_certificate_key../ssl/chat.key;ssl_session_cache shared:SSL:1m;ssl_session_timeout 5m;ssl_ciphers HIGH:!aNULL:!MD5;ssl_prefer_server_ciphers on;location/_auth{internal;proxy_pass http://127.0.0.1:8080/auth/check;proxy_pass_request_body off;proxy_set_header Content-Length;proxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For$proxy_add_x_forwarded_for;proxy_set_header X-Original-URI$request_uri;proxy_set_header X-Original-Method$request_method;proxy_set_header Cookie$http_cookie;proxy_set_header Authorization$http_authorization;proxy_set_header Token$http_token;proxy_http_version1.1;proxy_set_header Connection;}location /public{root html;index index.html index.htm;}location /private{set$main_args$args;auth_request /_auth;error_page401/public/index_401.html;error_page403/public/index_403.html;auth_request_set$user_id$upstream_http_x_user_id;auth_request_set$user_role$upstream_http_x_user_role;proxy_set_header X-User-Id$user_id;proxy_set_header X-User-Role$user_role;root html;index index.html index.htm;}}鉴权实现。packagecom.app.sso.user;importcom.app.sso.component.RequestUtil;importlombok.extern.slf4j.Slf4j;importorg.apache.commons.lang3.StringUtils;importorg.springframework.web.bind.annotation.GetMapping;importorg.springframework.web.bind.annotation.RequestMapping;importorg.springframework.web.bind.annotation.RestController;importorg.springframework.web.util.UriComponents;importorg.springframework.web.util.UriComponentsBuilder;importjavax.annotation.Resource;importjavax.servlet.http.HttpServletRequest;importjavax.servlet.http.HttpServletResponse;importjava.util.Enumeration;importjava.util.HashMap;importjava.util.Map;/** * author wym13 */Slf4jRestControllerRequestMapping(/auth)publicclassUserAuthController{ResourceprivateRequestUtilrequestUtil;privatestaticfinalStringMSG_MISSING_TOKEN未携带token;privatestaticfinalStringMSG_AUTH_SUCCESS认证成功;privatestaticfinalStringMSG_INVALID_TOKEN无权访问;GetMapping(/check)publicMapString,Objectauth(HttpServletRequestrequest,HttpServletResponseresponse){HashMapString,ObjectresultnewHashMap(2);Stringtokenrequest.getHeader(token);if(StringUtils.isBlank(token)){StringoriginalUrirequest.getHeader(X-Original-URI);if(StringUtils.isNotBlank(originalUri)){try{UriComponentscomponentsUriComponentsBuilder.fromUriString(http://dummyoriginalUri).build();tokencomponents.getQueryParams().getFirst(token);}finally{log.info(originalUri{},queryParamsToken{},originalUri,token);}}}if(StringUtils.isBlank(token)){log.info(鉴权失败token为空, IP{}, URI{},getClientIp(request),request.getRequestURI());response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);result.put(code,HttpServletResponse.SC_UNAUTHORIZED);result.put(msg,MSG_MISSING_TOKEN);returnresult;}else{if(requestUtil.checkToken(token)){response.setStatus(HttpServletResponse.SC_OK);result.put(code,HttpServletResponse.SC_OK);result.put(msg,MSG_AUTH_SUCCESS);}else{response.setStatus(HttpServletResponse.SC_FORBIDDEN);result.put(code,HttpServletResponse.SC_FORBIDDEN);result.put(msg,MSG_INVALID_TOKEN);log.info(鉴权失败token无效, IP{},getClientIp(request));}}returnresult;}// 工具方法获取客户端IPprivateStringgetClientIp(HttpServletRequestrequest){Stringiprequest.getHeader(X-Forwarded-For);if(StringUtils.isBlank(ip)||unknown.equalsIgnoreCase(ip)){iprequest.getRemoteAddr();}returnip;}}
