如何处理X-Forwarded-Host与X-Forwarded-Proto以阻止服务重定向到无效主机

一、Nginx 原生配置调整 #

要让请求匹配对应规则并阻止非法重定向，需在nginx.conf中添加X-Forwarded-Host校验规则，同时确保location规则优先级正确：

1. 添加全局主机白名单校验
   在http块中定义合法主机列表，直接拒绝非法的X-Forwarded-Host请求：

http {
    # 定义允许的合法主机，可添加多个
    map $http_x_forwarded_host $allowed_host {
        default 0;
        your-valid-domain.com 1;
        another-valid-domain.com 1;
    }

    server {
        listen 80;
        server_name your-valid-domain.com;

        # 优先校验主机合法性，非法请求直接返回403
        if ($allowed_host = 0) {
            return 403;
        }

        # 针对合法主机，处理X-Forwarded-Proto为http的情况，强制HTTPS重定向
        if ($http_x_forwarded_proto = "http") {
            return 301 https://$http_x_forwarded_host$request_uri;
        }

        # 业务服务的location配置
        location / {
            proxy_pass http://your-backend-service;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $remote_addr;
        }
    }
}

注意：map指令必须放在http块下；if指令顺序不可调换，先校验主机合法性再处理协议重定向。

2. 排查location匹配问题
   若请求仍未匹配对应location，检查：

• 是否存在优先级更高的location规则（比如带^~前缀或更具体的路径匹配）拦截请求
• 业务location的路径规则是否覆盖了目标请求路径，避免规则过于严格

二、Kubernetes Nginx Ingress 配置调整 #

仅靠force-ssl-redirect无法校验X-Forwarded-Host，需添加自定义配置片段实现主机白名单校验：

1. 完整Ingress配置示例

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: your-ingress
  annotations:
    nginx.ingress.kubernetes.io/enable-http2: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/use-forwarded-headers: "true" # 必须开启，让Ingress识别X-Forwarded-*头
    # 注入自定义配置，校验X-Forwarded-Host合法性
    nginx.ingress.kubernetes.io/configuration-snippet: |
      map $http_x_forwarded_host $allowed_host {
          default 0;
          your-valid-domain.com 1;
          another-valid-domain.com 1;
      }
      if ($allowed_host = 0) {
          return 403;
      }
spec:
  tls:
  - hosts:
    - your-valid-domain.com
    secretName: your-tls-secret
  rules:
  - host: your-valid-domain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: your-backend-service
            port:
              number: 80

2. 关键注意事项

• 必须开启use-forwarded-headers: "true"，否则Ingress会忽略客户端传入的X-Forwarded-Host和X-Forwarded-Proto头
• configuration-snippet中的map指令会被注入到Nginx的http块中，确保语法无错误

三、验证配置生效 #

1. 原生Nginx：执行nginx -s reload重载配置
2. Kubernetes环境：更新Ingress后，查看Ingress Controller日志确认配置加载：kubectl logs -n ingress-nginx <ingress-controller-pod-name>
3. 测试请求：

# 非法主机请求，应返回403
curl -H "X-Forwarded-Host: anydomain.com" -H "X-Forwarded-Proto: http" http://your-nginx-ip/

# 合法主机请求，应重定向到HTTPS
curl -v -H "X-Forwarded-Host: your-valid-domain.com" -H "X-Forwarded-Proto: http" http://your-nginx-ip/

内容的提问来源于stack exchange，提问作者Aishwarya