使用nginx auth_basic_user_file 模块bug #6685

printinfo · 2024-09-22T04:59:32Z

系统信息

外部链接：暂不公开（如协作需要请联系）
启动时间：2024/9/20 12点33分
版本：2.19.0
数据库：mysql 8.0/H2
操作系统：Ubuntu 20.04.6 LTS / CentOS Linux release 7.6.1810 (Core)
nginx：nginx/1.18.0 (Ubuntu) / nginx/1.20.1 Centos
apache2-utils ：2.4.41-4ubuntu3.21 / httpd-tools-2.4.6-99.el7.centos.1.x86_64

使用的哪种方式运行？

Docker

发生了什么？

多平台测试结果相同 Ubuntu20.04 / Cenots 7
多部署方式测试结果相同 Docker / JAR
使用nginx 反向代理到halo程序并auth_basic_user_file 模块设置登录账号密码出现重复登录情况，一直鉴权失败。nginx配置如下

server {
    listen 443 ssl;
    server_name xxx;
    ssl_certificate /etc/letsencrypt/live/xxx/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/xxx/privkey.pem;
    ssl_session_timeout 5m;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    client_max_body_size 50M;

    location / {
        auth_basic "require auth";
        auth_basic_user_file /etc/nginx/htpasswd;
        proxy_set_header Host $host;
        proxy_set_header Authorization $http_authorization;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:8080;
    }

    access_log /data/logs/nginx/xxx/access_log;
    error_log /data/logs/nginx/xxx/error_log;
}

htpasswd -c /etc/nginx/htpasswd user1

多次确认登录的密码没有错误，并且在nginx上把反向代理切换到其他静态页面会登录成功。

复现步骤

根据官方文档部署halo程序
下载安装nginx
下载安装httpd-tools
使用htpasswd创建账户
配置反向代理到halo项目
通过浏览器访问项目

附加信息

No response

The text was updated successfully, but these errors were encountered:

ruibaby · 2024-09-23T08:04:37Z

相同问题：#5408

/triage duplicate

JohnNiang · 2024-09-23T10:16:53Z

建议先移除掉下面这一行试试：

        proxy_set_header Authorization $http_authorization;

printinfo · 2024-09-23T10:22:59Z

建议先移除掉下面这一行试试：
        proxy_set_header Authorization $http_authorization;

删除这个试过也不行

JohnNiang · 2024-09-23T15:24:12Z

尝试添配置下内容：

server {
	server_name halo;
    location / {
        set $auth_basic_enabled "Require Auth";
        if ($http_authorization ~* "Bearer") {
            # Disable Basic Auth for Halo PAT
            set $auth_basic_enabled "off";
        }
        auth_basic $auth_basic_enabled;
        auth_basic_user_file /etc/nginx/conf.d/htpasswd;
        proxy_set_header Host $host;
        if ($http_authorization ~* "Basic") {
            # Don't pass Basic Authentication here.
            set $http_authorization "";
        }
        proxy_set_header Authorization $http_authorization;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://host.docker.internal:8090/;
    }
}

我实际测试是可以正常访问的，并且不影响 Halo 的个人令牌。测试结果如下所示：

http http://localhost:8080 Authorization:"Bearer pat_xxx"
HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Mon, 23 Sep 2024 15:23:29 GMT
Expires: 0
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.27.1
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
WWW-Authenticate: Bearer error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Invalid JWT serialization: Missing dot delimiter(s)", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0

http http://localhost:8080
HTTP/1.1 401 Unauthorized
Connection: keep-alive
Content-Length: 179
Content-Type: text/html
Date: Mon, 23 Sep 2024 15:21:45 GMT
Server: nginx/1.27.1
WWW-Authenticate: Basic realm="Require Auth"

<html>
<head><title>401 Authorization Required</title></head>
<body>
<center><h1>401 Authorization Required</h1></center>
<hr><center>nginx/1.27.1</center>
</body>
</html>

http -a admin:openadmin http://localhost:8080 -pHh
GET / HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Authorization: Basic YWRtaW46b3BlbmFkbWlu
Connection: keep-alive
Host: localhost:8080
User-Agent: HTTPie/3.2.3

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: keep-alive
Content-Language: en-CN
Content-Type: text/html
Date: Mon, 23 Sep 2024 15:26:19 GMT
Expires: 0
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.27.1
Transfer-Encoding: chunked
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
content-encoding: gzip
set-cookie: XSRF-TOKEN=43950cf6-4cdc-43a0-8dbb-9b87a73feac9; Path=/

printinfo · 2024-09-25T02:48:40Z

尝试添配置下内容：

server {
	server_name halo;
    location / {
        set $auth_basic_enabled "Require Auth";
        if ($http_authorization ~* "Bearer") {
            # Disable Basic Auth for Halo PAT
            set $auth_basic_enabled "off";
        }
        auth_basic $auth_basic_enabled;
        auth_basic_user_file /etc/nginx/conf.d/htpasswd;
        proxy_set_header Host $host;
        if ($http_authorization ~* "Basic") {
            # Don't pass Basic Authentication here.
            set $http_authorization "";
        }
        proxy_set_header Authorization $http_authorization;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://host.docker.internal:8090/;
    }
}

我实际测试是可以正常访问的，并且不影响 Halo 的个人令牌。测试结果如下所示：

http http://localhost:8080 Authorization:"Bearer pat_xxx"
HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Mon, 23 Sep 2024 15:23:29 GMT
Expires: 0
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.27.1
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
WWW-Authenticate: Bearer error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Invalid JWT serialization: Missing dot delimiter(s)", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0

http http://localhost:8080
HTTP/1.1 401 Unauthorized
Connection: keep-alive
Content-Length: 179
Content-Type: text/html
Date: Mon, 23 Sep 2024 15:21:45 GMT
Server: nginx/1.27.1
WWW-Authenticate: Basic realm="Require Auth"

<html>
<head><title>401 Authorization Required</title></head>
<body>
<center><h1>401 Authorization Required</h1></center>
<hr><center>nginx/1.27.1</center>
</body>
</html>

http -a admin:openadmin http://localhost:8080 -pHh
GET / HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Authorization: Basic YWRtaW46b3BlbmFkbWlu
Connection: keep-alive
Host: localhost:8080
User-Agent: HTTPie/3.2.3

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Connection: keep-alive
Content-Language: en-CN
Content-Type: text/html
Date: Mon, 23 Sep 2024 15:26:19 GMT
Expires: 0
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.27.1
Transfer-Encoding: chunked
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
content-encoding: gzip
set-cookie: XSRF-TOKEN=43950cf6-4cdc-43a0-8dbb-9b87a73feac9; Path=/

配置修改之后问题已经解决

JohnNiang · 2024-09-30T04:02:22Z

Halo 2.20（即将发布）我们将默认禁用 Basic 认证。届时可移除多余的配置。

#6689

f2c-ci-robot bot added the triage/duplicate Indicates an issue is a duplicate of other open issue. label Sep 23, 2024

printinfo closed this as completed Sep 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

使用nginx auth_basic_user_file 模块bug #6685

使用nginx auth_basic_user_file 模块bug #6685

printinfo commented Sep 22, 2024

ruibaby commented Sep 23, 2024

JohnNiang commented Sep 23, 2024

printinfo commented Sep 23, 2024

JohnNiang commented Sep 23, 2024 •

edited

Loading

printinfo commented Sep 25, 2024

JohnNiang commented Sep 30, 2024

使用nginx auth_basic_user_file 模块bug #6685

使用nginx auth_basic_user_file 模块bug #6685

Comments

printinfo commented Sep 22, 2024

系统信息

使用的哪种方式运行？

发生了什么？

复现步骤

相关日志输出

附加信息

ruibaby commented Sep 23, 2024

JohnNiang commented Sep 23, 2024

printinfo commented Sep 23, 2024

JohnNiang commented Sep 23, 2024 • edited Loading

printinfo commented Sep 25, 2024

JohnNiang commented Sep 30, 2024

JohnNiang commented Sep 23, 2024 •

edited

Loading