centos7,webman1.6,在本地使用openresty做反向代理.
http://本地域名:8080 反向到 192.168.31.11:8787
<?php
namespace app\middleware;
use Webman\Http\Request;
use Webman\Http\Response;
use Webman\MiddlewareInterface;
use Webman\RateLimiter\Limiter;
class LimiterMiddleware implements MiddlewareInterface {
public function process(Request $request, callable $handler): Response {
var_dump($request->getRealIp()); // 固定值,沒問題
Limiter::check($request->getRealIp(), 3, 15, '限流了');
$response = $handler($request);
return $response;
}
}
這段代碼再不使用反向代理情況下,非常正常.使用了反向代理后,最少有3分之2的請(qǐng)求攔截不了,也就是說無法觸發(fā)限流.
location ^~ / {
proxy_pass http://192.168.31.11:8787;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header REMOTE-HOST $remote_addr;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
add_header X-Cache $upstream_cache_status;
add_header Cache-Control no-cache;
proxy_ssl_server_name off;
proxy_ssl_name $proxy_host;
}
按照文檔配置 http://m.wtbis.cn/doc/webman/others/nginx-proxy.html
# 客戶端可以偽造ip
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
改成
# 客戶端無法偽造ip
proxy_set_header X-Forwarded-For $remote_addr;