Uzakwethu we-socket noma isihloko esidlulisiwe: yiliphi ikheli okufanele ulithembe?

Isicelo esifika kuhlelo lwakho sithwala izinhlobo ezimbili zobufakazi bekheli: uzakwethu ovule ukuxhumana kwenethiwekhi, kanye nensimu ye-HTTP ethi ikheli leklayenti langaphambilini. Ziphendula imibuzo ehlukene. Uzakwethu we-socket uyabonwa, kuyilapho isihloko sisho lowo osibhalile, futhi akukho okufanele kufake esinye esikhundleni somunye ngokuthula kungobo yomlando noma emthethweni wokufinyelela. Ukuqhathanisa okungezansi kuwahlukanisa, bese kukhombisa ukuhlelwa okuwukuphela kwako lapho isihloko siba wusizo khona.

Chaza indlela ngaphambi kokuqhathanisa noma yini:

Client -> approved reverse proxy -> application origin

Kulokho kuhlelwa, uzakwethu we-socket womthombo ngokuvamile uyi-proxy, futhi isihloko sokudlulisa singathwala isimangalo se-proxy mayelana neklayenti. Inani laso livela ebudlelwaneni obulawulwayo nale proxy, hhayi egameni lesihloko.

Izinhlobo ezimbili zobufakazi bekheli

Uzakwethu we-socket uyiqiniso mayelana nokuxhumana okukodwa kwe-TCP: okuthile kwaqeda ukuxhawula kusukela kulelo kheli. Akudingekile ukuthi kube ngumuntu, idivayisi noma i-akhawunti okhathazekile ngayo, ngoba i-VPN noma indlela yokuphuma ye-Tor kungaba umthombo oqashelwa yisevisi ngokusemthethweni. Noma kunjalo kuseyilona kuphela ikheli umsingathi azifakazela lona, futhi lokho kuyinani laso lonke.

Insimu yokudlulisa iyimethadatha mayelana nohlu. X-Forwarded-For, X-Real-IP kanye nensimu ejwayelekile Forwarded ingabhalwa yinoma yiliphi iklayenti elifinyelela iphoyinti lokugcina elizibuyisela, ngakho ukwethembeka kwazo kuncike ngokuphelele ekutheni ubani owayevunyelwe ukuzisetha.

Gcina kokubili kumongo wesicelo ngaphansi kwamagama ahlukene. Uhlelo olubhala ngaphezulu uzakwethu ngesihloko lulahlekelwa amandla okwakha kabusha iphutha lokuthembela kamuva, futhi yiso leso sikhathi lapho uwudinga khona.

Isihloko asilushintshi indlela yokuxhumana nanini

Ukubhala ikheli ensimini yokudlulisa akushintshi umthombo wokuxhumana kwe-TCP okufika kuseva, futhi akushintshi umzila wokuhamba kuyo yonke indlela. Umzila ojwayelekile we-VPN noma i-NAT yomthombo kuletha ithrafikhi ngaphandle kwanoma yisiphi isihloko se-HTTP. Ngokufanayo, isango lokudlula alibhali kabusha ukushintshana kwe-HTTPS okuvikelwe kahle ngaphandle kokushintsha ukuhlelwa kwephoyinti lokugcina le-TLS.

Iphutha eliphambene nalo livamile: i-HTTPS ayilwenzi lube yiqiniso isihloko sokudlulisa esinikezwe yiklayenti. Ivikela ukuthuthwa kwesimangalo esingamanga ngendlela efanayo nesesiqiniso.

Uma uzakwethu ehlongoza ushintsho lwesihloko ukuze kulungiswe inkinga yomzila, ukuxilonga sekwake kwahamba kabi. Lungisa indlela, noma lungisa ukuhlelwa kwe-proxy okubhala isihloko.

Shono igama le-proxy evunyelwe ukusho

Imithetho emibili yenza insimu yokudlulisa ibe wusizo, futhi yomibili ingukuhlelwa hhayi ikhodi. Umphetho ujwayelanisa noma ulahla konke okuvela ngaphandle, ngokokuziphatha kwawo okubhalisiwe kulezo zinsimu. Bese umthombo uthatha ikheli elingena esikhundleni kusukela endleleni ye-proxy oyishilo futhi hhayi kwenye indawo. Umthetho wesibili usebenza kuphela uma amaklayenti engakwazi ukufinyelela umthombo ngenye indlela, ngoba umthombo ophendula kokubili izicelo eziqondile neze-proxy awazi ukuthi yikuphi akusebenzelayo.

Imojuli ye-IP yangempela ye-NGINX ikhombisa ukwahlukana ngokucacile. set_real_ip_from isho abathumeli okubalwa isimangalo sabo, futhi real_ip_header isho ukuthi iyiphi insimu eyithwalayo; eyokuqala yenza ukuthembela, eyesibili isho kuphela lapho okufanele ubheke khona.

set_real_ip_from 10.20.0.0/24;
real_ip_header X-Forwarded-For;
# real_ip_recursive off - take the rightmost value in the field
# real_ip_recursive on  - walk the list back past every trusted address

Umyalo wokukhetha isihloko wodwa awukakamisi lutho mayelana nokuthi ubani othumele inani.

Ukuvikeleka kokuthutha kufanele kuhambe yonke indlela phakathi kwezingxenye ozethembayo. Umphetho ojwayelanisa kahle ulahlekelwa yilelo nani ngesikhathi lapho ukweqa okungavikelwe phansi kuvumela omunye umuntu ukuhlela isimangalo ngenkathi sihamba.

Phatha ngamabomu imigqa enezinyathelo eziningi

Ama-proxy amaningi adinga imodeli yomgqa ecacile. Ungathathi inani elingakwesokunxele noma kwesokudla elihlukaniswe ngokhefana ngoba iphosti yebhulogi yenza kanjalo; thola ukuthi iyiphi ye-proxy zakho eyengezayo, eyishintshayo noma egcina insimu engenayo. Isibonelo, i-NGINX ingahamba uhlu ihlehlela emuva uma iqhathaniswa neqoqo layo elithembekile futhi ime ekhelini lokuqala elingelona layo, futhi lowo umthetho walowo mkhiqizo, hhayi umthetho olandelwa yinoma yiluphi uhlaka. Funda imibhalo ye-proxy yakho ngemibuzo efanayo emibili: yiluphi inani elikhethayo, futhi ibathemba baphi abathumeli?

Bhala umgqa phansi: ukulandelana kwezinyathelo, isiphi isinyathelo esisetha insimu nokuthi isiphi isinyathelo esisusa amakhophi angenayo. Bese ugcina leyonyathelo eceleni kokuhlelwa kwe-proxy, hhayi ethikithini kuphela. Bese uyihlola ngokuthumela isicelo esinesihloko esingamanga ngohlelo lokuqinisekisa olugunyaziwe nokuqinisekisa ukuthi umthombo uyasishaya indiva.

Uma wengeza isinyathelo, buyekeza lolo mbhalo. Isilinganisi somthwalo esisha esifakwa phambi kwe-proxy ethembekile singashintsha ukuthi yiliphi ikheli eliphumelelayo ngaphandle kokuthi kube khona ohlela uhlelo.

Gcina kokubili ukubona kungobo yomlando

Lapho ukuxilonga kugunyaziwe, bhala kungobo yomlando uzakwethu wokuxhumana nekheli leklayenti elijwayelanisiwe njengezinsimu ezimbili ezihlukene, futhi wengeze kuphela imethadatha yokudlulisa edingwa ngempela yinhloso. Bese ufakazela ukusatshalaliswa ngezicelo ezimbili: esisodwa nge-proxy okufanele sibhale womabili amanani ngendlela enengqondo, nesinye isilingo esiqondile emthonbeni okufanele senqatshwe.

Khumbula ukuthi isibhangqwana sisho ukuthini. Isihloko sengeza umongo onikezwa yingxenye oyikhethile ukuyithemba; uzakwethu usala kuyilona kuphela ikheli umsingathi wakho akubona ngempela. Akukho kokubili okuwubufakazi bobuwena bomuntu ngamunye, futhi umklamo othatha noma yikuphi kwalokhu njengobufakazi uzophutha ngomuntu othile.