[Nginx] 使用Nginx和Lua进行JWT校验介绍

• 前言
  
• lua脚本
  
• nignx.conf配置
  
• dockerfile配置
  

-- nginx-jwt.lua
 
 
local cjson = require "cjson"
local jwt = require "resty.jwt"
 
--your secret
local secret = "yoursecrethere"
--无需鉴权api清单
local no_need_token_api_list = {'/api/register', '/api/login'}
 
local function ignore_url (val)
  for index, value in ipairs(no_need_token_api_list) do
    if (value == val) then
      return true
    end
  end
 
  return false
end
 
local m = {}
 
 
function m.auth()
 
  if ignore_url(ngx.var.request_uri) then
    return
  else
  end
  
  -- require authorization request header
  local auth_header = ngx.var.http_authorization
 
  if auth_header == nil then
    ngx.log(ngx.warn, "no authorization header")
    ngx.exit(ngx.http_unauthorized)
  end
 
  -- require bearer token
  local _, _, token = string.find(auth_header, "bearer%s+(.+)")
 
  if token == nil then
    ngx.log(ngx.err, "missing token")
    ngx.exit(ngx.http_unauthorized)
  end
 
  --decode_base64和后端保持一致
  local jwt_obj = jwt:verify(ngx.decode_base64(secret), token)
 
  if jwt_obj.verified == false then
    ngx.log(ngx.err, "invalid token: ".. jwt_obj.reason)
    ngx.status = ngx.http_unauthorized
    ngx.say(cjson.encode(jwt_obj))
    ngx.header.content_type = "application/json; charset=utf-8"
    ngx.exit(ngx.http_unauthorized)
  end
 
end
 
return m

worker_processes 1;
 
events
{
  worker_connections 1024;
}
http
{
 
  lua_package_path "/opt/lua-resty-jwt/lib/?.lua;;";
 
  upstream backend
  {
  server 192.168.1.1:8080;
  }
  
  access_log /logs/nginx_access.log;
  error_log /logs/nginx_error.log;
 
  server
  {
 
  listen 80;
 
  #后端api接口代理
  location /api/
  {
    access_by_lua_block
    {
    local obj = require('nginx-jwt')
    obj.auth()
    }
    proxy_pass http://backend;
    proxy_redirect off;
    proxy_set_header host $host;
    proxy_set_header x-real-ip $remote_addr;
    proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
  }
  }
 
}