相关推荐:How to log the real client IP on embedded Tomcat access log on Spring Boot application with Nginx as reverse proxy

logging always write the proxy IP address (127.0.0.1) instead of the real client IP.Is the X-Real-IP header used to get the real client IPIs this header used by tomcat to write the IP address in the access logI

如果你的tomcat应用需要采用ssl来加强安全性,一种做法是把tomcat配置为支持ssl,另一种做法是用nginx反向代理tomcat,然后把nginx配置为https访问,并且nginx与tomcat之间配置为普通的http协议即可。下面说的是后一种方法,同时假定我们基于spring-boot来开发应用。

一、配置nginx:

server {
    listen 80;
    listen 443 ssl;
    server_name localhost;

    ssl_certificate server.crt;
    ssl_certificate_key server.key;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
    }
}

这里有三点需要说明:

1、nginx允许一个server同时支持http和https两种协议。这里我们分别定义了http:80和https:443两个协议和端口号。如果你不需要http:80则可删除那行。

2、nginx收到请求后将通过http协议转发给tomcat。由于nginx和tomcat在同一台机里因此nginx和tomcat之间无需使用https协议。

3、由于对tomcat而言收到的是普通的http请求,因此当tomcat里的应用发生转向请求时将转向为http而非https,为此我们需要告诉tomcat已被https代理,方法是增加X-Forwared-Proto和X-Forwarded-Port两个HTTP头信息。

二、接着再配置tomcat。基于spring-boot开发时只需在application.properties中进行配置:

server.tomcat.remote_ip_header=x-forwarded-for
server.tomcat.protocol_header=x-forwarded-proto
server.tomcat.port-header=X-Forwarded-Port
server.use-forward-headers=true

该配置将指示tomcat从HTTP头信息中去获取协议信息(而非从HttpServletRequest中获取),同时,如果你的应用还用到了spring-security则也无需再配置。

此外,由于spring-boot足够自动化,你也可以把上面四行变为两行:

server.tomcat.protocol_header=x-forwarded-proto
server.use-forward-headers=true

下面这样写也可以:

server.tomcat.remote_ip_header=x-forwarded-for
server.use-forward-headers=true

 但不能只写一行:

server.use-forward-headers=true

具体请参见http://docs.spring.io/spring-boot/docs/1.3.0.RELEASE/reference/htmlsingle/#howto-enable-https,其中说到:

server.tomcat.remote_ip_header=x-forwarded-for
server.tomcat.protocol_header=x-forwarded-proto
The presence of either of those properties will switch on the valve

 此外,虽然我们的tomcat被nginx反向代理了,但仍可访问到其8080端口。为此可在application.properties中增加一行:

server.address=127.0.0.1

这样一来其8080端口就只能被本机访问了,其它机器访问不到。 

相关推荐:Running A Spring Boot App (Embedded Tomcat) with SSL and Unencrypted Simultaneously

one with SSL and one without SSL. I am using an embedded Tomcat 8.SSL is currently being configured using@Bean@Profile('tls')EmbeddedServletContainerCustomizer servletContainerCustomizer ()throws Exception {

快照源:http://www.cnblogs.com/yang-wu/p/5107899.html