我正在嘗試在 Docker 中設定一堆服務：Unifi、PHP、Nginx 和 Certbot，其中 Unifi 和 PHP 是後端服務，Nginx 以反向代理模式為它們提供服務，而 Certbot 定期運行以獲取 Nginx 的 SSL 憑證。
我大部分時間都在工作；所有 GET 請求都有效，我可以查看 Unifi 提供的頁面。然而，由於 CORS，任何透過 AJAX 的 POST 請求都會拋出 403 錯誤。
現在，我不太熟悉如何操作 CORS 標頭，或導致錯誤的原因。是瀏覽器、Nginx 還是 unifi？不過，我只能更改 Nginx 的設定。
這是我從瀏覽器檢查器/網路監視器收到的所有 AJAX post 請求的錯誤：
POST
scheme https
host example.com:8443
filename /api/stat/device
Address (server_ip_address):8443
Status 403 Forbidden
Version HTTP/2
Transferred 141 B (0 B size)
Referrer Policy strict-origin-when-cross-origin
RESPONSE HEADERS
content-length 0
content-type text/plain
date Fri, 17 Sep 2021 00:59:09 GMT
server nginx
X-Firefox-Spdy h2
REQUEST HEADERS
Accept application/json, text/plain, */*
Accept-Encoding gzip, deflate, br
Accept-Language en-US,en;q=0.5
Connection keep-alive
Content-Length 0
Cookie unifises=(random token here); csrf_token=(random token here)
DNT 1
Host example.com:8443
Origin https://example.com:8443
Referer https://example.com:8443/setup/configure/controller-name
Sec-Fetch-Dest empty
Sec-Fetch-Mode cors
Sec-Fetch-Site same-origin
TE trailers
User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
X-Csrf-Token (random token here)
這是 Nginx 設定：
# enbables GZIP compression
gzip on;
# compression level (1-9)
# 6 is a good compromise between CPU usage and file size
gzip_comp_level 6;
# minimum file size limit in bytes to avoid negative compression
gzip_min_length 256;
# compress data for clients connecting via proxies
gzip_proxied any;
# directs proxies to cache both the regular and GZIp versions of an asset
gzip_vary on;
# disables GZIP compression for ancient browsers
gzip_disable "msie6";
server {
listen 80;
listen [::]:80;
server_name example.com;
location ~ /.well-known/acme-challenge {
allow all;
root /var/www/certbot/;
}
# Redirect relevant Unifi paths Unifi Address and Port
location / {
rewrite ^ https://$host:8443$request_uri?;
}
}
server {
listen 8443 ssl http2;
listen [::]:8443 ssl http2;
server_name example.com;
server_tokens off;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_buffer_size 8k;
ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
ssl_ecdh_curve secp384r1;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 1.0.0.1 208.67.222.222 208.67.220.220;
location / {
add_header 'Access-Control-Allow-Origin' '*';
add_header 'Access-Control-Allow-Credentials' 'true';
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
proxy_pass https://unifi:8443/;
proxy_set_header Authorization "";
proxy_pass_request_headers on;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Host $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Ssl on;
proxy_http_version 1.1;
proxy_buffering off;
proxy_redirect off;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
auth_basic "Restricted";
proxy_set_header Referer "";
}
}
我厭倦了在 Stack Exchange 內外查找更多指南，超出了我的追蹤範圍，因此我的配置現在如此混亂。
那麼，如何修改 Nginx 以服務 XHR 請求而不會因 CORS 而失敗？
編輯 1：我將連接埠 443 新增至 Nginx 偵聽連接埠以及 8443。但是，我需要它在 8443 上透明地工作。
編輯2：我嘗試新增另一個「中間人」Nginx 容器，並稍微修改了設定。我將對原始 Nginx 容器上的連接埠 8443 的請求代理到連接埠 443 上的第二個容器，並將其反向代理到 8443 上的 Unifi。所以Web -> Nginx on 8443 -> Nginx on 443 -> Unfi on 8443。
