WSO2-IS反向代理配置后Carbon登录出现403禁止访问问题求助

一、修正WSO2 IS的deployment.toml配置 #

替换现有配置为以下内容（根据实际环境调整参数）：

[server]
offset = "1"
hostname = "example.com"
node_ip = "xxx.xxx.xx.xxx"
base_path = "https://$ref{server.hostname}/is"
proxy_context_path = "/is"

[transport.https.properties]
proxyPort = 443

# 配置Tomcat识别反向代理头部
[tomcat]
remote_ip_valve.enabled = true
remote_ip_valve.internal_proxies = "xxx.xxx.xx.xxx" # 替换为Nginx服务器的IP
remote_ip_valve.remote_ip_header = "X-Forwarded-For"
remote_ip_valve.protocol_header = "X-Forwarded-Proto"

# 调整CSRF验证适配反向代理
[security.csrf]
enable_csrf_protection = true
allowed_origins = ["https://example.com"]
use_forwarded_host = true

二、优化Nginx配置 #

移除冗余的/carbon/admin/js/csrfPrevention.js location块，调整/is/ location配置：

server {
    server_name example.com;
    access_log  /var/log/nginx/dev_mtz_access.log;
    error_log  /var/log/nginx/example.com.error_log debug;

    ssl_protocols TLSv1.2 TLSv1.3; # 推荐仅保留安全协议版本
    listen 80;
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/certs/cup.crt;
    ssl_certificate_key /etc/letsencrypt/private/cup.key;

    # 强制HTTP跳转HTTPS
    if ($scheme != "https") {
        return 301 https://$server_name$request_uri;
    }

    rewrite \w*(carbon|admin)$ $1/ permanent;

    location /is/ {
        proxy_pass                            https://csm-wso2-is:9444/;
        # 统一替换跳转路径，避免暴露内部地址
        proxy_redirect                        ~^https://example.com/(.*)$ https://example.com/is/$1;
        proxy_redirect                        default;

        proxy_http_version                    1.1;
        proxy_cache_bypass                    $http_upgrade;

        # 必须传递的代理头部
        proxy_set_header Upgrade              $http_upgrade;
        proxy_set_header Connection           $connection_upgrade;
        proxy_set_header Host                 $host;
        proxy_set_header X-Forwarded-For      $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Server   $host;
        proxy_set_header X-Forwarded-Host     $host;
        proxy_set_header X-Forwarded-Proto    $scheme; # 传递HTTPS协议标识

        # 超时配置
        proxy_connect_timeout                 3600s;
        proxy_send_timeout                    3600s;
        proxy_read_timeout                    3600s;
    }
}

# 处理WebSocket升级映射
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

三、关键配置说明 #

• base_path必须指向代理后的完整外部地址，否则WSO2生成的跳转URL会暴露内部端口。
• Tomcat Remote IP Valve用于让WSO2识别真实客户端IP和请求协议，避免反向代理导致的安全验证失败。
• CSRF配置中use_forwarded_host=true允许WSO2使用X-Forwarded-Host头部验证请求来源，这是解决403错误的核心调整。
• Nginx中移除冗余的csrfPrevention.js location，避免循环代理；添加X-Forwarded-Proto确保WSO2识别HTTPS请求。

四、验证步骤 #

1. 重启WSO2 Identity Server和Nginx服务。
2. 访问https://example.com/is/carbon尝试登录，检查是否正常跳转且无403错误。
3. 测试密码重置、创建密码等功能，确认内部IP和端口未暴露。

内容的提问来源于stack exchange，提问作者Aldo Inácio da Silva