SignalR+NGINX反向代理环境下CORS跨域错误求助

1. 修正API Gateway的ForwardedHeaders配置 #

生产环境通过Nginx反向代理时，API Gateway需要正确识别客户端真实请求信息（包括Origin），需添加ForwardedHeaders配置并调整中间件顺序：

// 在Program.cs的builder.Services区域添加
builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    // 添加Nginx服务器的IP地址到可信代理列表，生产环境建议指定具体IP/子网
    options.KnownProxies.Add(IPAddress.Parse("你的Nginx服务器IP"));
    // 容器环境可使用子网，例如：
    // options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("172.17.0.0"), 16));
});

// 确保ForwardedHeaders中间件在CORS之前执行
app.UseForwardedHeaders();

app.UseCors(x => x
    .AllowAnyMethod()
    .AllowAnyHeader()
    .SetIsOriginAllowed(origin => true)
    .AllowCredentials());

app.MapReverseProxy(proxyPipeline =>
{
    proxyPipeline.UseAuthentication(); 
    proxyPipeline.UseAuthorization(); 
    // 移除此处的UseForwardedHeaders，全局已配置
});

2. 调整Nginx的SignalR路由配置 #

Nginx需要转发真实的Origin头到后端，并正确处理CORS预请求（OPTIONS方法）：

location /hub/myhub {
    proxy_pass        $forward_scheme://$server:$port$request_uri;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header Origin $http_origin; # 关键：转发客户端真实Origin
    proxy_cache_bypass $http_upgrade;
    
    # 处理CORS预请求，直接返回204并带上必要头
    if ($request_method = OPTIONS) {
        add_header Access-Control-Allow-Origin $http_origin;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
        add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,Upgrade";
        add_header Access-Control-Allow-Credentials "true";
        add_header Content-Length 0;
        add_header Content-Type text/plain;
        return 204;
    }
}

3. 验证配置 #

使用curl测试预请求是否返回正确的CORS头：

curl -X OPTIONS -H "Origin: https://myfrontend.com" -H "Access-Control-Request-Method: POST" -v https://myserver.com/hub/myhub/negotiate

响应头中应包含Access-Control-Allow-Origin: https://myfrontend.com和Access-Control-Allow-Credentials: true。

内容的提问来源于stack exchange，提问作者Febertson