将WWW强制置于AWS EC2负载均衡器之后 [英] Force WWW behind an AWS EC2 Load Balancer

问题描述

我提出了一个小问题，我们正在为新项目使用负载平衡器，但是我们不能强制使用www.在请求之间没有重定向循环.

I've come up with a small issue, we're using a load balancer for a new project, but we cannot force the www. without having a redirect loop between requests.

我们当前正在使用NGINX，重定向的代码段如下:

We're currently using NGINX, and the snippet to redirect is the following:

# FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/mywebsite.com/before/*;

# FORGE CONFIG (DOT NOT REMOVE!)
include upstreams/mywebsite.com;

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name .mywebsite.com;
    
    if ($host !~* ^www\.){
        rewrite ^(.*)$ https://www.mywebsite.com$1;
    }

    # FORGE SSL (DO NOT REMOVE!)
    ssl_certificate /etc/nginx/ssl/mywebsite.com/225451/server.crt;
    ssl_certificate_key /etc/nginx/ssl/mywebsite.com/225451/server.key;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    charset utf-8;

    access_log off;
    error_log  /var/log/nginx/mywebsite.com-error.log error;

    # FORGE CONFIG (DOT NOT REMOVE!)
    include forge-conf/mywebsite.com/server/*;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;

        proxy_pass http://370308_app/;
        proxy_redirect off;

        # Handle Web Socket Connections
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

# FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/mywebsite.com/after/*;

---

HTTP服务器NGINX CONFIG

# FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/mywebsite.com/before/*;

server {
    listen 80;
    listen [::]:80;
    server_name .mywebsite.com;
    root /home/forge/mywebsite.com/public;
    
    if ($host !~* ^www\.){
        rewrite ^(.*)$ https://www.mywebsite.com$1;
    }

    # FORGE SSL (DO NOT REMOVE!)
    # ssl_certificate;
    # ssl_certificate_key;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/nginx/dhparams.pem;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";

    index index.html index.htm index.php;

    charset utf-8;

    # FORGE CONFIG (DOT NOT REMOVE!)
    include forge-conf/mywebsite.com/server/*;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location = /favicon.ico { access_log off; log_not_found off; }
    location = /robots.txt  { access_log off; log_not_found off; }

    access_log off;
    error_log  /var/log/nginx/mywebsite.com-error.log error;

    error_page 404 /index.php;

    location ~ \.php$ {
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
    }

    location ~ /\.(?!well-known).* {
        deny all;
    }
}

# FORGE CONFIG (DOT NOT REMOVE!)
include forge-conf/mywebsite.com/after/*;

---

问题是，使用此配置，我只能从服务器获取重定向循环.

---

Thing is, with this config I'm only getting redirect loops from the server.

请帮助:D< 3

Help please :D <3

推荐答案

写完先前的通用答案后，我，这是第一个结果:

After writing the prior general-purpose answer, I Googled "FORGE CONFIG (DOT NOT REMOVE!)", and this was the first result:

https://laracasts.com/discuss/channels/forge/forge-how-to-disable-nginx-default-redirection

在nginx/forge-conf/be106.net/before/redirect.conf文件中，有一个简单的配置:

inside nginx/forge-conf/be106.net/before/redirect.conf file there is this simple config:

…
server_name www.my-domain.net;
return 301 $scheme://my-domain.net$request_uri;
…

是否有一种简单的方法可以删除此文件，而无需更改文件本身(看起来像个坏主意).

is there a simple way of removing this without altering the file itself(as it look like bad idea).

因此，似乎重定向是由您正在使用的应用程序引起的，因此，我们找到了最可能导致循环的原因！

So, it appears that the redirect is being caused by the application you're using, so, we found the most likely cause of the loop!

反过来，配置您的应用程序以避免所述循环的适当方法将不在StackOverflow的评分范围之内.

In turn, the appropriate way to configure your application to avoid said loop would be outside of the score of StackOverflow.

但是，作为一种解决方法:

However, as a workaround:

• 考虑在负载均衡器级别上是否实际上需要所有这些forge-conf include指令；随后，您可以伪造要传递给后端的不会导致重定向的适当域(前提是您删除了自己的冗余重定向):

• consider whether you actually need all those forge-conf include directives at the load-balancer level; subsequently, you could fake the appropriate domain to be passed to the backend that would not cause a redirect (provided you remove your own redundant redirects):

-        proxy_set_header Host $http_host;
+        proxy_set_header Host example.com;

请注意，forge-conf/example.com/before/redirect.conf指令优先于您自己的.example.com配置的原因是该指令的顺序-您可以将/before/* include移到您自己的配置之后，如果这样的话在其他方面还是有意义的.

note that the reason the forge-conf/example.com/before/redirect.conf directive takes precedence over your own configuration for .example.com is the order of the directive — you could potentially move the /before/* include to be after your own configuration, if such a move would otherwise make sense.

这篇关于将WWW强制置于AWS EC2负载均衡器之后的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！