Nginx鉴权、限流问题

http_auth_request_module

nginx -V 2>&1 | grep -- 'http_auth_request_module'

server
{
	listen 80;

	location = /checkToken {
		internal;
		proxy_pass_request_body off;
		proxy_set_header Content-Length "";
		proxy_set_header via $request_uri;
		proxy_pass $auth_request_url;
	}

	location = /auth401 {
		add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate";
		if ( $arg_via = "001" ) {
			return 401 "{\"msg\":\"登录凭证为空\",\"opCode\":\"001\",\"operateSuccess\":false}";
        }
		if ( $arg_via = "002" ) {
			return 401 "{\"msg\":\"登录凭证失效\",\"opCode\":\"002\",\"operateSuccess\":false}";
        }
        if ( $arg_via = "003" ) {
			return 401 "{\"msg\":\"账户无权限\",\"opCode\":\"003\",\"operateSuccess\":false}";
        }
	}

	location /test/api/ {
		set $auth_request_url "http://127.0.0.1:8080/test/api/token/check?token=$arg_token";
		auth_request /checkToken;
		auth_request_set $auth_via $upstream_http_via;
		error_page 401 = /auth401?via=$auth_via;
		
		proxy_pass http://127.0.0.1:8080/test/api/;
	}

}

import org.apache.commons.lang3.StringUtils;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
import javax.annotation.Resource;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Map;
import java.util.Set;

@RestController
@RequestMapping("/api/token")
public class TokenRest {

	@Resource
	private RedisTemplate redisTemplate;

	@GetMapping(value="check")
	public void checkRest(HttpServletRequest request, HttpServletResponse response) {
		response.setStatus(401);
		try {
			String url = request.getHeader("via");
			if (StringUtils.isNotEmpty(url) && url.contains("?")) {
				url = url.substring(0, url.indexOf("?"));
			}
			// 白名单跳过验证
			String flag = (String) redisTemplate.opsForHash().get("whiteCache", url);
			if (StringUtils.isNotEmpty(flag)) {
				response.setStatus(200);
				return;
			}
			// 从Head或url中获取token
			String token = request.getParameter("token");
			if (StringUtils.isEmpty(token) || "null".equals(token)) {
				token = request.getHeader("Authorization");
				if (token!=null && token.startsWith("Bearer ")) {
					token = token.substring(7);
				}
			}
			if (StringUtils.isEmpty(token) || "null".equals(token)) {
				response.setHeader("via", "001");
				return;
			}
			// 从Redis中获取账户信息
			String accountId = (String) redisTemplate.opsForValue().get(token);
			if (accountId == null) {
				response.setHeader("via", "002");
				return;
			}
			Map<String, String> info = (Map<String, String>) redisTemplate.opsForValue().get(accountId);
			if (info == null) {
				response.setHeader("via", "003");
				return;
			}
			String[] roleIds = info.get("roles").split(",");
			for (String roleId : roleIds) {
				Set<String> securityUrls = (Set<String>) redisTemplate.opsForHash().get("funcCache",roleId);
				if (securityUrls.contains(url)) {
					flag = "1";
					break;
				}
			}
			if ("1".equals(flag)) {
				response.setStatus(200);
			} else {
				response.setHeader("via", "003");
			}
		} catch (Exception e) {
			System.err.println(e.getMessage());
		}
	}
}

http
{
	limit_req_zone $binary_remote_addr zone=limit_req:10m rate=2r/s;
}

server
{
	location = /test.htm {
		limit_req zone=limit_req burst=10 nodelay;
		alias C:/nginx/html/test.htm;
	}
}

http
{
	limit_conn_zone $binary_remote_addr zone=limit_conn:10m;
}

server
{
	location = /test.htm {
		limit_conn limit_conn 2;
		alias C:/nginx/html/test.htm;
	}
}