关于 nginx 反向代理， HTTP 正常， HTTPS 访问报 403 错误

反向代理转发的是一个 JSP 的网址，在 HTTP 访问正常，HTTPS 带证书访问就会报 403 错误，而且证书没有问题，HTTPS 转发其他页面可以正常转发，下面是配置文件，大神指导下是否需要调整参数，谢谢！

#user nobody;
worker_processes 1;

#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;

#pid logs/nginx.pid;

events {
worker_connections 1024;
}

http {
include mime.types;
default_type application/octet-stream;

#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';

#access_log logs/access.log main;

sendfile on;
tcp_nopush on;

#keepalive_timeout 0;
keepalive_timeout 65;

gzip on;

upstream ncc{
ip_hash;
server 10.0.3.21:9081 weight=10;
server 10.0.3.21:9082 weight=10;
server 10.0.3.21:9083 weight=10;
keepalive 300;
}

server {
listen 80;
server_name localhost;
index index.jsp;
location / {
allow all;
index index.jsp index.html;
proxy_pass http://ncc;
proxy_set_header Host $http_host;
proxy_set_header Cookie $http_cookie;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
client_max_body_size 100m;
client_body_buffer_size 256k;
proxy_buffering off;
proxy_connect_timeout 1;
proxy_send_timeout 30;
proxy_read_timeout 60;
proxy_buffer_size 256k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
proxy_temp_file_write_size 256k;
proxy_max_temp_file_size 128m;
}
}
server {
listen 443 ssl;
#error_page 497 301 =307 https://$host:443$request_uri;
server_name localhost;
ssl_certificate cert/piepchina.pem;
ssl_certificate_key cert/piepchina.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
location / {
allow all;
index index.jsp index.html;
proxy_pass http://ncc;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header Cookie $http_cookie;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Upgrade-Insecure-Requests 1;
}
}

}

throns

2020-11-04 18:06:16 +08:00

我刚遇到了这个问题。我这边的情况是，nginx 服务反向代理 k8s （用了 nginx ingress ）的服务，同样是 http 正常访问，https 的 get 请求也正常访问，但 https 的 post 请求失败，只报了 403，没有别的错误提示，我后来测了一下，用 postman 可以正常调用 post 请求，但浏览器调用失败，隐约觉得是跨域的问题，后来发现真的是，后端（ gin ） AllowOrigins 只允许了 http，没有允许 https，后端加上之后就可以了，只是不知道为什么只报了 403，没有报跨域的提示。不知道是不是 gin-contrib/cors 的问题，还是整个链路比较长导致的问题。