.NET 8 Blazor Server（Linux+Nginx）配Cloudflare重定向过多无法加载

以下是实际可行的修复步骤，按顺序排查配置：

1. 调整Cloudflare SSL/TLS模式 #

• 登录Cloudflare控制台，进入你的域名→SSL/TLS→概述
• 根据Nginx的HTTPS配置选择对应模式：
  • 如果Nginx已配置有效HTTPS证书（如Let's Encrypt），选择严格模式
  • 如果Nginx暂时仅运行HTTP，选择灵活模式（建议尽快配置Nginx HTTPS）
• 确保Cloudflare的「始终使用HTTPS」选项，不会和Nginx的HTTP转HTTPS配置重复触发跳转

2. 修正Nginx代理配置 #

编辑Blazor应用的Nginx配置文件，添加以下关键配置：

server {
    listen 80;
    server_name your-domain.com; # 替换为你的域名
    # HTTP转HTTPS，仅当Cloudflare SSL模式为严格时启用
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name your-domain.com;

    # 配置HTTPS证书路径
    ssl_certificate /path/to/your/cert.pem;
    ssl_certificate_key /path/to/your/key.pem;

    # 信任Cloudflare代理IP，获取真实客户端IP
    set_real_ip_from 103.21.244.0/22;
    set_real_ip_from 103.22.200.0/22;
    set_real_ip_from 103.31.4.0/22;
    set_real_ip_from 104.16.0.0/13;
    set_real_ip_from 104.24.0.0/14;
    set_real_ip_from 108.162.192.0/18;
    set_real_ip_from 131.0.72.0/22;
    set_real_ip_from 141.101.64.0/18;
    set_real_ip_from 162.158.0.0/15;
    set_real_ip_from 172.64.0.0/13;
    set_real_ip_from 173.245.48.0/20;
    set_real_ip_from 188.114.96.0/20;
    set_real_ip_from 190.93.240.0/20;
    set_real_ip_from 197.234.240.0/22;
    set_real_ip_from 198.41.128.0/17;
    set_real_ip_from 2400:cb00::/32;
    set_real_ip_from 2606:4700::/32;
    set_real_ip_from 2803:f800::/32;
    set_real_ip_from 2405:b500::/32;
    set_real_ip_from 2405:8100::/32;
    set_real_ip_from 2a06:98c0::/29;
    set_real_ip_from 2c0f:f248::/32;
    real_ip_header CF-Connecting-IP;
    real_ip_recursive on;

    # 传递转发头给Blazor应用，识别HTTPS协议
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header Host $host;

    # 主应用代理
    location / {
        proxy_pass http://localhost:5000; # 替换为你的Blazor应用端口
        proxy_cache_bypass $http_upgrade;
    }

    # WebSocket代理（Blazor Server核心路径）
    location /_blazor {
        proxy_pass http://localhost:5000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

配置完成后重启Nginx：

sudo systemctl restart nginx

3. 配置Blazor Server信任反向代理 #

编辑Program.cs，添加转发头处理配置，让应用正确识别Cloudflare的代理请求：

var builder = WebApplication.CreateBuilder(args);

// 添加HTTP上下文访问器
builder.Services.AddHttpContextAccessor();

// 配置转发头，信任Cloudflare代理
builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    
    // 添加Cloudflare的IP网段到信任列表
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("103.21.244.0"), 22));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("103.22.200.0"), 22));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("103.31.4.0"), 22));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("104.16.0.0"), 13));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("104.24.0.0"), 14));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("108.162.192.0"), 18));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("131.0.72.0"), 22));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("141.101.64.0"), 18));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("162.158.0.0"), 15));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("172.64.0.0"), 13));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("173.245.48.0"), 20));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("188.114.96.0"), 20));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("190.93.240.0"), 20));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("197.234.240.0"), 22));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("198.41.128.0"), 17));
    // IPv6网段同理添加
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("2400:cb00::"), 32));
    options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("2606:4700::"), 32));
});

// 其他服务注册（如AddRazorComponents等）
builder.Services.AddRazorComponents()
    .AddInteractiveServerComponents();

var app = builder.Build();

// 启用转发头处理，必须放在其他中间件之前
app.UseForwardedHeaders();

// 其他中间件配置（如UseHttpsRedirection、UseStaticFiles等）
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseAntiforgery();

app.MapRazorComponents<App>()
    .AddInteractiveServerRenderMode();

app.Run();

重新发布并重启Blazor应用：

# 停止现有应用服务（假设用systemd管理）
sudo systemctl stop your-blazor-app.service
# 发布应用
dotnet publish -c Release
# 启动服务
sudo systemctl start your-blazor-app.service

4. 检查Cloudflare页面/缓存规则 #

• 进入Cloudflare控制台→规则→页面规则，删除任何可能导致重复重定向的规则（如重复的HTTPS强制跳转）
• 进入缓存→缓存规则，添加规则排除/_blazor路径的缓存，避免干扰WebSocket连接

内容的提问来源于stack exchange，提问作者Eduard Rivas