Skip to content

Commit 3e9ba83

Browse files
iTraceuriTraceur
committed
First commit
0 parents  commit 3e9ba83

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+6120
-0
lines changed

‎.gitignore

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
nginx-http-auth
2+
conf/app.conf
3+
gitversion
4+
nohup.out
5+
6+
*.exe
7+
*.swp
8+
*.log
9+
*.pid
10+
*.tmp
11+
12+
.idea
13+
.vscode
14+
.DS_Store

‎conf/app.example.conf

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
appname = nginx-http-auth
2+
httpport = 8080
3+
runmode = dev
4+
5+
# Session
6+
sessionon = true
7+
sessionname = SessionID
8+
sessiongcmaxlifetime = 86400
9+
sessioncookielifetime = 86400
10+
sessionprovider = redis
11+
sessionproviderconfig = "127.0.0.1:6379"
12+
13+
14+
# XSRF
15+
enablexsrf = true
16+
xsrfkey = 4b6774f328ee1a2f24fcb62842fc0cfc
17+
xsrfexpire = 86400
18+
19+
20+
authAPI = http://127.0.0.1:5000/api/login
21+
controlUsers = admin;iTraceur;zhaowencheng
22+
23+
[ipControl]
24+
deny =
25+
direct = 127.0.0.1;192.168.1.5
26+
27+
[timeControl]
28+
deny =
29+
direct =
30+
31+
[userControl]
32+
deny = test;
33+
allow =

‎conf/nginx.conf

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
error_log logs/error.log debug;
2+
3+
events { }
4+
5+
http {
6+
proxy_cache_path cache/ keys_zone=auth_cache:10m;
7+
proxy_headers_hash_max_size 512;
8+
proxy_headers_hash_bucket_size 128;
9+
10+
upstream auth-backend {
11+
server 127.0.0.1:8080;
12+
}
13+
14+
server {
15+
listen 80;
16+
17+
location / {
18+
auth_request /auth-proxy;
19+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
20+
proxy_set_header Host $http_host;
21+
22+
# 认证后端使用了XSRF过滤，使用Nginx内部重定向会导致XSRF验证失效，
23+
# 因为，登录页面Get请求是由Nginx完成的，但Post请求是客户端完成的，这两个HTTP请求会分别分配给两个不同beego.Controller实例来处理，
24+
# 又因为XSRF Token保存在beego.Controller实例中随机生成的，所以Get和Post请求对应的XSRF Token不一样导致校验失败，
25+
# 因此，这里需要使用named location，在named location返回一个302响应，全部由客户端进行重定向和处理XSRF
26+
error_page 401 =200 @error401;
27+
}
28+
29+
location @error401 {
30+
# 302跳转后，无法获取到之前的uri来设置X-Target头，因此，在302跳转的url加上target参数以达到相同效果
31+
return 302 /passport/login?target=$request_uri;
32+
}
33+
34+
location = /auth-proxy {
35+
internal;
36+
37+
proxy_pass http://auth-backend/auth-proxy;
38+
proxy_pass_request_body off;
39+
proxy_set_header Content-Length "";
40+
proxy_set_header X-CookieName "SessionID";
41+
proxy_set_header Cookie SessionID=$cookie_SessionID;
42+
43+
proxy_cache auth_cache;
44+
proxy_cache_valid 200 10m;
45+
proxy_cache_key "$http_authorization$cookie_SessionID";
46+
}
47+
48+
location /passport/login {
49+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
50+
proxy_set_header Host $http_host;
51+
# proxy_set_header X-Target $request_uri; # target通过url地址参数target来设置
52+
proxy_pass http://auth-backend/passport/login;
53+
}
54+
55+
location /passport/logout {
56+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
57+
proxy_set_header Host $http_host;
58+
proxy_pass http://auth-backend/passport/logout;
59+
}
60+
61+
location /captcha {
62+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
63+
proxy_set_header Host $http_host;
64+
proxy_pass http://auth-backend/captcha;
65+
}
66+
67+
location /favicon.ico {
68+
alias /var/www/site/assets/img/favicon.ico;
69+
proxy_set_header Host $host;
70+
proxy_set_header X-Real-IP $remote_addr;
71+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
72+
}
73+
74+
location /static {
75+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
76+
proxy_set_header Host $http_host;
77+
proxy_pass http://auth-backend/static;
78+
}
79+
}
80+
}

‎control

+124
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
#!/bin/bash
2+
3+
WORKSPACE=$(cd $(dirname $0)/; pwd)
4+
cd $WORKSPACE
5+
6+
app=$WORKSPACE"/nginx-http-auth"
7+
pidfile=$WORKSPACE"/nginx-http-auth.pid"
8+
logfile=$WORKSPACE"/nginx-http-auth.log"
9+
conf=$WORKSPACE"/conf/app.conf"
10+
11+
function check_pid() {
12+
if [ -f $pidfile ];then
13+
pid=`cat $pidfile`
14+
if [ -n $pid ]; then
15+
running=`ps -p $pid|grep -v "PID TTY" |wc -l`
16+
return $running
17+
fi
18+
fi
19+
return 0
20+
}
21+
22+
function start() {
23+
check_pid
24+
running=$?
25+
if [ $running -gt 0 ];then
26+
echo -n "$app now is running already, pid="
27+
cat $pidfile
28+
return 1
29+
fi
30+
31+
if ! [ -f $conf ];then
32+
echo "Config file $conf doesn't exist, creating one."
33+
cp $WORKSPACE"/conf/app.example.conf" $conf
34+
fi
35+
nohup $app &> $logfile &
36+
echo $! > $pidfile
37+
echo "$app started..., pid=$!"
38+
}
39+
40+
function stop() {
41+
pid=`cat $pidfile`
42+
kill $pid
43+
echo "$app stoped..."
44+
}
45+
46+
function restart() {
47+
stop
48+
sleep 1
49+
start
50+
}
51+
52+
function status() {
53+
check_pid
54+
running=$?
55+
if [ $running -gt 0 ];then
56+
echo started
57+
else
58+
echo stoped
59+
fi
60+
}
61+
62+
function tailf() {
63+
tail -f $logfile
64+
}
65+
66+
function build() {
67+
cd $WORKSPACE
68+
echo $1
69+
70+
if [ "$1" == "linux" ] ;then
71+
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build
72+
elif [ "$1" == "windows" ] ;then
73+
CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build
74+
else
75+
go build
76+
fi
77+
78+
if [ $? -ne 0 ]; then
79+
exit $?
80+
fi
81+
}
82+
83+
function pack() {
84+
build $1
85+
git log -1 --pretty=%h > gitversion
86+
version=`$app -v`
87+
file_list="nginx-http-auth static views control conf/app.example.conf conf/nginx.conf"
88+
echo "...tar $app-$version.tar.gz <= $file_list"
89+
tar zcf $app-$version.tar.gz gitversion $file_list
90+
}
91+
92+
function packbin() {
93+
build $1
94+
git log -1 --pretty=%h > gitversion
95+
version=`$app -v`
96+
tar zcvf $app-bin-$version.tar.gz nginx-http-auth gitversion
97+
}
98+
99+
function help() {
100+
echo "$0 build|pack|start|stop|restart|status|tail"
101+
}
102+
103+
if [ "$1" == "" ]; then
104+
help
105+
elif [ "$1" == "stop" ];then
106+
stop
107+
elif [ "$1" == "start" ];then
108+
start
109+
elif [ "$1" == "restart" ];then
110+
restart
111+
elif [ "$1" == "status" ];then
112+
status
113+
elif [ "$1" == "tail" ];then
114+
tailf
115+
elif [ "$1" == "build" ];then
116+
build $2
117+
elif [ "$1" == "pack" ];then
118+
pack $2
119+
elif [ "$1" == "packbin" ];then
120+
packbin $2
121+
else
122+
help
123+
fi
124+

‎controllers/auth_proxy.go

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package controllers
2+
3+
import (
4+
beego "github.com/beego/beego/v2/server/web"
5+
)
6+
7+
type AuthProxyController struct {
8+
beego.Controller
9+
}
10+
11+
func (this *AuthProxyController) Get() {
12+
this.Ctx.Output.Header("Cache-Control", "no-cache")
13+
uname := this.GetSession("uname")
14+
if uname == nil {
15+
this.Ctx.Abort(401, "401")
16+
return
17+
}
18+
this.Ctx.Output.Body([]byte("ok"))
19+
}

‎controllers/control.go

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
package controllers
2+
3+
import (
4+
"fmt"
5+
"path/filepath"
6+
"reflect"
7+
"time"
8+
9+
"github.com/beego/beego/v2/core/logs"
10+
beego "github.com/beego/beego/v2/server/web"
11+
"github.com/toolkits/file"
12+
13+
"nginx-http-auth/g"
14+
"nginx-http-auth/utils"
15+
)
16+
17+
type ControlController struct {
18+
beego.Controller
19+
}
20+
21+
func (this *ControlController) Get() {
22+
clientIP := this.Ctx.Input.IP()
23+
logtime := time.Now().Format("02/Jan/2006 03:04:05")
24+
25+
uname := this.GetSession("uname")
26+
if uname == nil {
27+
this.Ctx.Redirect(302, "/passport/login")
28+
return
29+
}
30+
31+
controlUsers, err := beego.AppConfig.Strings("controlUsers")
32+
if err != nil {
33+
logs.Error(err.Error())
34+
this.Ctx.Output.SetStatus(500)
35+
this.Ctx.WriteString("Internal Server Error")
36+
return
37+
}
38+
if !utils.InSlice(uname.(string), controlUsers) {
39+
logs.Debug(uname.(string), controlUsers, controlUsers[0], reflect.TypeOf(controlUsers[0]))
40+
this.Ctx.Output.SetStatus(401)
41+
this.Ctx.Output.Body([]byte("Not Allowed"))
42+
return
43+
}
44+
45+
control := this.Ctx.Input.Param(":control")
46+
switch control {
47+
case "version":
48+
this.Ctx.Output.Body([]byte(g.VERSION))
49+
case "health":
50+
this.Ctx.Output.Body([]byte("ok"))
51+
case "config":
52+
var json map[string]interface{}
53+
err = beego.AppConfig.Unmarshaler("", &json)
54+
if err != nil {
55+
logs.Error(err.Error())
56+
this.Ctx.Output.SetStatus(500)
57+
this.Ctx.WriteString("Internal Server Error")
58+
return
59+
}
60+
this.Data["json"] = json
61+
this.ServeJSON()
62+
case "reload":
63+
err := beego.LoadAppConfig("ini", filepath.Join(file.SelfDir(), "conf/app.conf"))
64+
if err != nil {
65+
logs.Error(fmt.Sprintf("%s - - [%s] Config reload failed: %s", clientIP, logtime, err.Error()))
66+
this.Ctx.Output.Body([]byte("config reload failed"))
67+
} else {
68+
logs.Notice(fmt.Sprintf("%s - - [%s] Config Reloaded", clientIP, logtime))
69+
this.Ctx.Output.Body([]byte("config reloaded"))
70+
}
71+
}
72+
}

‎controllers/default.go

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package controllers
2+
3+
import (
4+
beego "github.com/beego/beego/v2/server/web"
5+
"nginx-http-auth/g"
6+
)
7+
8+
type MainController struct {
9+
beego.Controller
10+
}
11+
12+
func (this *MainController) Get() {
13+
uname := this.GetSession("uname")
14+
if uname == nil {
15+
this.Ctx.Redirect(302, "/passport/login")
16+
return
17+
}
18+
this.Ctx.Output.Body([]byte("nginx-http-auth, version " + g.VERSION))
19+
}

‎controllers/error.go

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package controllers
2+
3+
import (
4+
beego "github.com/beego/beego/v2/server/web"
5+
)
6+
7+
type ErrorController struct {
8+
beego.Controller
9+
}
10+
11+
func (this *ErrorController) Error401() {
12+
this.Data["content"] = "限制访问，请求被拒绝"
13+
this.TplName = "deny.tpl"
14+
}
15+
16+
func (this *ErrorController) Error403() {
17+
this.Data["content"] = "当前时间段不允许访问"
18+
this.TplName = "deny.tpl"
19+
}

0 commit comments

Comments
 (0)