Position:Home > Play-Scala开发技巧 - 关闭X-Forwarded-For解析

Play-Scala开发技巧 - 关闭X-Forwarded-For解析

1. 为什么要关闭X-Forwarded-For解析?

    某些用户可能会使用透明代理访问你的网站,透明代理在转发请求的时候会通过X-Forwarded-For请求头带上真实的请求IP地址,默认情况下,Play会解析这个请求头并赋值给request.remoteAddress,进而导致在Action中通过request.remoteAddress获取到的IP地址是一个内网地址,例如192.168.1.2。这些内网地址对地域统计来说没有任何意义,所以索性就关闭X-Forwarded-For解析,直接获取代理服务器地址。

2. 如何关闭X-Forwarded-For解析?

    很简单,只需要在application.conf配置文件中增加一行配置即可关闭所有X-Forwarded-For解析.

play.http.forwarded.trustedProxies = []

3.  如何启用X-Forwarded-For解析?

     如果使用Nginx做反向代理服务器,修改/etc/nginx/nginx.conf,告诉Nginx添加相应的请求头:

http {
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-Proto $scheme;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header   Host $http_host;
    proxy_http_version 1.1;
}    

1) 仅信任本地的反向代理服务器

play.http.forwarded.trustedProxies=["::1", "127.0.0.1"]

2) 信任特定的代理服务器

play.http.forwarded.trustedProxies=["192.168.0.0/24", "::1", "127.0.0.1"]

192.168.0.0/24表示整个C类地址段,即192.168.0.0-192.168.0.255。

Recommend:Logging syntax for Play Framework 2 in Scala

in Play Framework 2 (and in Scala). I've googled but its very difficult to find an example, essentially most links are talking about configuring Logback in the first place which I've done fine. I'm basically trying to f

3) 信任所有的代理服务器

play.http.forwarded.trustedProxies=["0.0.0.0/0", "::/0"]

4. 参考

Setting up a front end HTTP server

 

 

 

 

Recommend:scala - Play too many arguments for method Apply

onfigured it this way: controller Application.scala package controllersimport play.api._import play.api.mvc._class Application extends Controller { def index = Action { Ok(views.html.index("Hello, again, worl

Recommend:angularjs - Using Angular with Play: Role for Scala Templates

entasks sample and the fluid, clean, effortless Javascript routing that left the work of rendering things to Play. But we decided instead to go with Angular. Upon going down that road, I thought that Angular would contro

Your Answer
(Ctrl+Enter To Post)   
    Copyright © 2015-2017 163JAVA.COM All Rights Reserved.