Nginx反向代理移动端访问返回Access Denied问题求助

部署nginx/1.20.1版本反向代理服务，用于访问一批基于用户所在国家/地区做访问限制的网站，其余大量同配置代理域名运行正常，仅1个主域名及下属2个子域名的移动端游戏启动场景存在异常：桌面端、其余移动端场景访问均正常，仅手机端打开对应游戏时固定返回403报错。

现有核心配置 #

反向代理主配置 #

upstream somename443     { server some.domain.com:443; }

server {
    if ($host = some-name.proxied.org) {
        return 301 https://$host$request_uri;
    }
        server_name  some-domain.proxied.org;
        listen       111.11.1.111:80;
        access_log  /var/log/nginx/domain-proxied.access.log compression;
        error_log   /var/log/nginx/domain-proxied.error.log debug;
        location /.well-known {
            root /var/www/html/proxy;
        }
}


server {
        server_name  some-domain.proxied.org;
        listen       111.11.1.111:443 ssl http2;
        access_log   /var/log/nginx/domain-proxied.access.log compression;
        error_log    /var/log/nginx/domain-proxied.error.log  debug;
        location / {
            root /var/www/html/proxy;
            try_files $uri @static;
        }
        location @static {
                proxy_pass https://somename443;
                proxy_set_header Host   real.domain.com;
                proxy_ssl_server_name on;
                proxy_ssl_name real.domain.com;
                include './sites-available/location.conf.inc';
        }
    ssl_certificate /etc/letsencrypt/live/proxied.domain.org/fullchain.pem; 
    ssl_certificate_key /etc/letsencrypt/live/proxied.domain.org/privkey.pem;
         ssl_session_timeout 1d;
         ssl_stapling on;
         ssl_session_cache shared:SSL:50m;
         ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
         ssl_prefer_server_ciphers on;
         ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-A
}

公共引入配置文件location.conf.inc #

proxy_buffering on;
proxy_request_buffering on;
proxy_http_version 1.1;
proxy_set_header Accept-Encoding "";
proxy_connect_timeout 300s;
proxy_send_timeout 300s;
proxy_read_timeout 300s;
proxy_buffer_size 16k;
proxy_buffers 4 64k;
proxy_max_temp_file_size 0;
proxy_busy_buffers_size 128k;
proxy_temp_file_write_size 128k;
client_max_body_size 10m;
client_body_buffer_size 128k;
sub_filter_once off;
sub_filter_types *;

proxy_cookie_domain     'realdomain.com'                         'proxieddomain.org';
proxy_cookie_domain     'realdomain.com'                         'proxieddomain.org';
sub_filter              'realdomain.com'                         'proxieddomain.org';
sub_filter              'realdomain.com'                        'proxieddomain.org';
proxy_redirect          http://realdomain.com                    https://proxieddomain.com;
proxy_cookie_domain     'realdomain.com'                         'proxieddomain.org';

故障详情 #

故障固定出现在请求经过反向代理、发起POST请求访问游戏启动路径时，返回报错内容如下：

Access Denied
You don't have permission to access "https://first-proxied-subdomain.org/mobile-game-launcher/GameLauncher" on this server.

Reference #numbers

对应异常请求头信息如下：

Request URL: https://first-sub-domain.org/mobile-game-launcher/GameLauncher
Request Method: POST
Status Code: 403 
Content-Encoding: gzip
Content-Type: text/html
Date: Fri, 08 Jul 2022 09:40:57 GMT
Expires: Fri, 08 Jul 2022 09:40:57 GMT
mime-version: 1.0
Server: nginx/1.20.1
Provisional headers are shown
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: application/x-www-form-urlencoded
Origin: https://absolutely-another-proxied-domain.org
Referer: https://absolutely-another-proxied-domain.org/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Mobile/15E148 Safari/604.1
gameId: starburst_mobile_html_sw
disableDeviceDetection: false
showHomeButton: false
gameLocation: games/starburst_mobile_html/
preBuiltGameRulesSupported: true
server: https://second-sub-domain.org/
lang: en
sessid: 1657272794779-94881-NTFKQ9DI2I007
operatorId: default
gameURL: https://firs-sub-domain.org/games/game_mobile_html/game/game_mobile_html.xhtml

• 故障涉及两个子域名：first-proxied-subdomain.org、second-proxied-subdomain.org，二者业务逻辑上存在互相发起GET/POST请求交互的行为。
• 经多轮排查未定位根因，需可行的排查思路与解决方案。

内容的提问来源于stack exchange，提问作者paul