使用 Nginx 反向代理限制 SOAP 调用

Question

我们为反向代理配置了一个 Nginx 服务器，以保护无法修补的老化 SOAP 服务器。

我被要求限制客户端可以从特定 IP 范围进行的调用。

我不知道如何允许某些 SOAP 调用但过滤掉其他调用。

Nginux 配置是

server  {
  listen 443;
  listen [::]:443;
  server_name shiny.nginx.server;
  ssl on;
  ssl_certificate "/public/directory/proxy.pem";
  ssl_certificate_key "/secret/directory/proxy.key";
  location / {
    proxy_pass http://very.old.server:80/;
    proxy_buffering                     off;
    proxy_set_header Host               $http_host;
    proxy_set_header X-Real-IP          $remote_addr;
    proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto  $scheme;
    auth_basic                          "Username and Password Required";
    auth_basic_user_file                /etc/nginx/.htpasswd;
  }
}

有什么想法可以实现吗？

谢谢

Answer 1

我找到了解决方法。

server  {
    listen 443;
    listen [::]:443;
    server_name shiny.nginx.server;
    ssl on;
    ssl_certificate "/public/directory/proxy.pem";
    ssl_certificate_key "/secret/directory/proxy.key";
    location / {
    proxy_pass http://very.old.server:80/;
    proxy_buffering                     off;
    proxy_set_header Host               $http_host;
    proxy_set_header X-Real-IP          $remote_addr;
    proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto  $scheme;
    auth_basic                          "Username and Password Required";
    auth_basic_user_file                /etc/nginx/.htpasswd;

    if ($remote_addr ~ 192.168.1.1) {
        set $is_user Y;
    }
    if ($http_soapaction ~ SOAP/Request/Goes/Here) {
        set $user_allowed Y;
    }
    set $user_test "${is_user}${user_allowed}";
    if ($user_test = YY) {
        set $good yes;
    }

    if ($good != yes) {
        return 403;
    }
}

无法进行嵌套或复杂的测试让它变得有点棘手...

使用 Nginx 反向代理限制 SOAP 调用

Restrict SOAP calls using Nginx Reverse Proxy

soap

nginx-reverse-proxy