Laravel 8.x在Azure App Service中签名URL验证失败问题排查

问题概述 #

本地环境将.env的APP_URL设为自定义DNShttps://some-project.local，通过以下代码生成临时签名URL：

$temporaryUrl = URL::temporarySignedRoute('temp.download', now()->addHours(24), ($struct = [
    'uid' => Str::uuid()->toString(),
    // ...
]));

路由验证逻辑如下：

public function tempDownload(string $uuid, Request $request)
{
    if ($request->hasValidSignature()) {
        abort(401);
    }
}

本地运行正常，但部署到Azure开发/测试/生产环境后始终返回401。已确认APP_URL配置为https://XXXXXXXXX.azurewebsites.net，且修改了TrustProxies中间件：

class TrustProxies extends Middleware
{
    protected $proxies = '*';
    protected $headers = Request::HEADER_X_FORWARDED_ALL;
}

调试发现X-FORWARDED-HOST为null，Nginx日志显示请求IP始终为Azure代理的链路本地地址（169.254.XXX.X），需基于server _;配置动态调整Nginx，让PHP-FPM获取正确的请求信息。

核心问题分析 #

Azure应用服务通过反向代理转发请求，Laravel生成签名URL时依赖正确的请求主机、协议信息。当前Nginx未将代理传递的X-Forwarded-*头正确传递给PHP-FPM，导致签名验证时的主机/协议与生成时不匹配，触发401错误。

解决方案 #

1. 修正Nginx配置，传递代理头信息 #

在server _;块中添加以下配置，确保Azure代理的请求头被正确传递给PHP-FPM：

server {
    listen 80;
    server_name _;
    root /home/site/wwwroot/public;
    index index.php index.html;

    # 识别Azure代理IP段，获取真实客户端IP
    set_real_ip_from 169.254.0.0/16;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ [^/]\.php(/|$) {
        # 新增：传递代理头给PHP-FPM
        fastcgi_param HTTP_X_FORWARDED_HOST $http_x_forwarded_host;
        fastcgi_param HTTP_X_FORWARDED_PROTO $http_x_forwarded_proto;
        fastcgi_param HTTP_X_FORWARDED_PORT $http_x_forwarded_port;
        fastcgi_param SERVER_NAME $http_x_forwarded_host;

        # 保留原有FPM配置
        fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
        fastcgi_pass 127.0.0.1:9000;
        include fastcgi_params;
        fastcgi_param HTTP_PROXY "";
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_intercept_errors on;

        fastcgi_connect_timeout         300;
        fastcgi_send_timeout           3600;
        fastcgi_read_timeout           3600;

        fastcgi_busy_buffers_size 512k;
        fastcgi_buffer_size 512k;
        fastcgi_buffers 16 512k;
        fastcgi_temp_file_write_size 512k;

        fastcgi_hide_header "x-powered-by";
    }
}

• set_real_ip_from 169.254.0.0/16：指定Azure代理的IP段，让Nginx正确识别真实客户端IP
• 新增的fastcgi_param参数：将Azure传递的X-Forwarded-*头直接传给PHP，确保Laravel获取正确的主机、协议信息
• SERVER_NAME $http_x_forwarded_host：覆盖默认值，让PHP使用代理传递的真实主机名

2. 修正路由验证逻辑的笔误 #

原代码逻辑错误，会在签名有效时返回401，需改为：

public function tempDownload(string $uuid, Request $request)
{
    if (!$request->hasValidSignature()) {
        abort(401);
    }
}

3. 确认TrustProxies中间件启用 #

检查app/Http/Kernel.php的全局中间件栈，确保TrustProxies已启用：

protected $middleware = [
    // ...
    \App\Http\Middleware\TrustProxies::class,
    // ...
];

4. 清除配置缓存 #

部署后执行以下命令清除Laravel缓存：

php artisan config:clear
php artisan route:clear

验证方法 #

添加调试路由确认头信息是否正确：

Route::get('/debug', function (Request $request) {
    return response()->json([
        'APP_URL' => env('APP_URL'),
        'X-Forwarded-Host' => $request->header('X-Forwarded-Host'),
        'X-Forwarded-Proto' => $request->header('X-Forwarded-Proto'),
        'SERVER_NAME' => $_SERVER['SERVER_NAME'],
    ]);
});

访问该路由后，确认X-Forwarded-Host等于Azure应用域名，X-Forwarded-Proto为https，则配置生效。

内容的提问来源于stack exchange，提问作者Jaquarh