Nginx：proxy_pass+websocket+基本认证+Safari=访问日志的无尽循环。

Question

Safari (桌面& iOS)

Meteor Web应用程序由nginx基本认证保护。

我看到以下的访问日志记录 循环往复 当我在Safari上访问该应用程序时。Chrome浏览器可以正常工作。nginx错误日志中没有任何记录出现。我的猜测是由于某种原因，用户密码的auth不工作，请求在循环中被重定向，导致新的socket sockjs连接被打开。

应用程序不产生任何输出，显示白屏死亡。

144.MY.IP.ADDR - - [25/Sep/2018:17:48:06 -0400] "GET /sockjs/958/msx234wb/websocket HTTP/1.1" 401 195 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Safari/605.1.15"
144.MY.IP.ADDR - username [25/Sep/2018:17:48:06 -0400] "POST /sockjs/656/mgln1mi5/xhr_send HTTP/1.1" 204 0 "https://my.site.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Safari/605.1.15"
144.MY.IP.ADDR - username [25/Sep/2018:17:48:06 -0400] "POST /sockjs/958/x9wngcy3/xhr HTTP/1.1" 200 12 "https://my.site.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Safari/605.1.15"
144.MY.IP.ADDR - username [25/Sep/2018:17:48:06 -0400] "POST /sockjs/958/x9wngcy3/xhr_send HTTP/1.1" 204 0 "https://my.site.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Safari/605.1.15"
144.MY.IP.ADDR - username [25/Sep/2018:17:48:06 -0400] "GET /sockjs/info?cb=35tsuy5ber HTTP/1.1" 200 90 "https://my.site.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Safari/605.1.15"
144.MY.IP.ADDR - username [25/Sep/2018:17:48:06 -0400] "POST /sockjs/958/x9wngcy3/xhr_send HTTP/1.1" 204 0 "https://my.site.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Safari/605.1.15"

这是我的nginx配置。

map $http_upgrade $connection_upgrade {
  default upgrade;
  ''      close;
}

server {
    listen 80;
    listen 443 ssl http2;
    server_name my.site.com;

    ssl_certificate /etc/letsencrypt/live/my.site.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/my.site.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    add_header Strict-Transport-Security "max-age=31557600; includeSubDomains";
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Xss-Protection "1";

    ssl_stapling on;
    ssl_stapling_verify on;

    root html; # irrelevant
    index index.html; # irrelevant

    location / {

        # forward http to https
        if ($scheme = http) {
            return 301 https://$server_name$request_uri;
        }

        proxy_pass      http://localhost:8080;

        proxy_redirect off;
        proxy_intercept_errors on;


        proxy_http_version 1.1; # recommended with keepalive connections - http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_http_version

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        proxy_set_header Host $host;  # pass the host header - http://wiki.nginx.org/HttpProxyModule#proxy_pass

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-Proto http;
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-For $remote_addr; # preserve client IP

        proxy_set_header X-Nginx-Proxy true;

        auth_basic "Restricted Access";         # auth realm
        auth_basic_user_file .htpasswd-users;   # htpasswd file

        # the root path (/) MUST NOT be cached
        if ($uri != '/') {
            expires 30d;
        }

    }
}

我不知道为什么会发生这种情况，Chrome浏览器能正常工作，而Safari却不能。

Answer 1

这里是解决方案。保存的魔法 proxy_read_timeout 行。

location / {          

    auth_basic "Restricted Access"; # auth realm
    auth_basic_user_file .htpasswd-users-paco; # htpasswd file

    proxy_set_header   X-Forwarded-For $remote_addr;
    proxy_set_header   Host $http_host;

    proxy_pass         "http://127.0.0.1:SOME_PORT";
    proxy_http_version 1.1;

    proxy_set_header   Upgrade $http_upgrade;
    proxy_set_header   Connection "upgrade";            

    proxy_read_timeout 86400;            

    # the root path (/) MUST NOT be cached
    if ($uri != '/') {
        expires 30d;
    }
}