Kubernetes代理环境下Ruby on Rails应用CSRF令牌丢失及422错误求助

场景描述 #

本地Docker构建并运行Ruby-On-Rails应用时，localhost:3000可正常启动，登录页面能成功登录。但将代码发布到Docker仓库并部署到Kubernetes集群后，登录请求返回422 Unprocessable Entity错误。

错误状态码：

Status Code: 422 Unprocessable Entity

调试差异 #

本地和生产环境的浏览器网络面板均能看到Cookie，但生产环境Cookie缺失csrftoken字段：

本地环境Cookie #

csrftoken=7tzlvuigfaUatDBMTEJUBE53OREXHxOJ1ZzJ8h4cuHvnvUza0xLH2lglIFZ1gS4S; __profilin=p=t; _app_session=BBr2bnKi6qYJwW4yvQUU0J3Q2K8JW2i9DZ5zJS0qQmCc48uRNbPrThJhbzhnGXrxLDwD/Y8ZAW5w/x2VhXeotq3TWjWcjVucUzNPA6u6ePMcN8O7XVfcIwV2HR/aGpJ1oxB1B/TbsAcfB4LaSqckVWMZ70anWDOD+xFz0xkKPiOkd++NwnMuWix2TyaicqXmQ+JsK1yWacS2dnTWvC70xyX38JjuC/VUqu2hUFIQHeNuK7Gfp7lMCh0MEJeob43lFhgFZLOJXTC+rPYIUxMTN3aIwD0=--LsM3EqEzNEglvj6H--RHcx/5CRIYG/CWJMUER1eQ==

生产环境Cookie #

__profilin=p=t; _app_session=FWpoSIJ8zzB8nkRsF2A30f552HjyAVlwbMva/HN4vnKaTECnPWzfWoc/+P9k/xO+fpmd2j9ntxLFOnflB5vttwxpLL1RtjZWcPmpCWfdR0nqG3EOLPLK9yR0xrvmfKMbFsYeJ2F/hZrJIs+4iOO92CioXo1s51sZX5E3R6c9XIKn5NjHUKWKuEArVV/4MibTg/CSqPWyH3lg1bjxKoZvixSZUBdtxTq1sW5NKsJnnwPgC0ZSkQzsSquCwcxKEf9L1wPxgZQTLGRREY7JeD/+mUc0WL4=--n+JNO4hoF17EGI5K--vY2DcanQEF7ICpZwDxq9tg==

即使将生产环境的RAILS_ENV设置为development，仍会出现422错误。

架构说明 #

所有流量先经过运行Apache2的门户代理服务器（负责处理域名SSL证书），再通过HTTP转发到内部网络，Nginx-Ingress-Controller仅处理内部HTTP流量。已尝试配置Nginx和Apache的请求头来处理CSRF请求，但问题未解决。

日志排查结果 #

查看Rails日志发现关键警告：

I, [2022-12-12T08:16:40.202890 #1]  INFO -- : [f785b7f7f797c67c0ab0f008e8a0eb83] Started POST "/login" for 192.168.1.10 at 2022-12-12 08:16:40 +0000                                                    
I, [2022-12-12T08:16:40.204343 #1]  INFO -- : [f785b7f7f797c67c0ab0f008e8a0eb83] Processing by AuthController#login as HTML                                                                             
I, [2022-12-12T08:16:40.204460 #1]  INFO -- : [f785b7f7f797c67c0ab0f008e8a0eb83]   Parameters: {"authenticity_token"=>"[FILTERED]", "login"=>{"email"=>"myemail@gmail.com", "password"=>"[F
W, [2022-12-12T08:16:40.204795 #1]  WARN -- : [f785b7f7f797c67c0ab0f008e8a0eb83] HTTP Origin header (https://my.site.com) didn't match request.base_url (http://my.site.com)                  
I, [2022-12-12T08:16:40.205536 #1]  INFO -- : [f785b7f7f797c67c0ab0f008e8a0eb83] Completed 422 Unprocessable Entity in 1ms (ActiveRecord: 0.0ms | Allocations: 192)                                     
F, [2022-12-12T08:16:40.207591 #1] FATAL -- : [f785b7f7f797c67c0ab0f008e8a0eb83]

当前配置信息 #

Ingress资源配置 #

annotations:
    nginx.org/proxy-connect-timeout: 3600s
    nginx.org/proxy-read-timeout: 3600s
    nginx.org/proxy-send-timeout: 3600s
    nginx.org/proxy-pass-headers: "Set-Cookie"
    nginx.ingress.kubernetes.io/proxy-body-size: "8g"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "Host              $http_host";
      more_set_headers "X-Real-IP         $remote_addr";
      more_set_headers "X-Forwarded-Proto $scheme";
      more_set_headers "X-Forwarded-For   $proxy_add_x_forwarded_for";

Apache配置 #

<VirtualHost *:80>

    ServerName my.site.com

    ProxyRequests Off
    <Proxy *>
      Order deny,allow
      Allow from all
    </Proxy>

    ProxyPreserveHost on
    ProxyPass / http://192.168.1.8/
    ProxyPassReverse / http://192.168.1.8

        RewriteEngine on
        RewriteCond %{SERVER_NAME} =my.site.com
        RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

<IfModule mod_ssl.c>

        <VirtualHost *:443>

                ServerName my.site.com

                ProxyRequests Off
                <Proxy *>
                  Order deny,allow
                  Allow from all
                </Proxy>

                SSLProxyEngine On
                SSLProxyCheckPeerCN on
                SSLProxyCheckPeerExpire on

                ProxyPreserveHost on
                ProxyPass / http://192.168.1.8/
                ProxyPassReverse / http://192.168.1.8

                Include /etc/letsencrypt/options-ssl-apache.conf

                ErrorLog /var/log/apache2/sites/my.site.com/error.log
                CustomLog /var/log/apache2/sites/my.site.com/access.log combined

                SSLCertificateFile /etc/letsencrypt/live/my.site.com/fullchain.pem
                SSLCertificateKeyFile /etc/letsencrypt/live/my.site.com/privkey.pem
        </VirtualHost>

</IfModule>

已尝试在Apache配置中添加RequestHeader set X-Forwarded-Proto "https"，但无任何变化。

提问 #

需要修改哪些配置才能解决该CSRF问题？

内容的提问来源于stack exchange，提问作者A. Vreeswijk