《Nginx+Lua在網(wǎng)絡(luò)安全方面的應(yīng)用》理財(cái)范 周為

NGINX防護(hù)的基本方式UserAgentFrequencyLimit/MasterreMEMMasterreMEMRead/WriteWorkeWorkerWorkerWorkerWorkerNGINX配置繼承模型MMainentsServerLocationLocationServer復(fù)合條件下復(fù)合條件下的IF配置實(shí)例if($remote_addr~"^(12.34|56.78)"){set$flag"${flag}1";}if($http_user_agent~*"spider"){set$flag"${flag}1";}if($flag="011"){return403;}違反直覺的違反直覺的IF配置實(shí)例location/test{set$true1;if($true){add_headerX-First1;}if($true){add_headerX-Second2;}return204;}NginNginx被廣泛應(yīng)用的Web服務(wù)器NginxNginx+Lua技術(shù)棧NginxInitPhaseNginxRewriteNginxInitPhaseNginxRewrite/AccessNginxContentPhaseNginxLogPhaseinitinit_by_luainitinit_worker_by_luasetset_by_luarewriterewrite_by_luaaccessaccess_by_luacontentcontent_by_luabodybody_?lter_by_lualoglog_by_luaHelloworldworker_processes1;events{worker_connections1024;}http{server{listen8080;location/{default_typetext/html;content_by_lua'ngx.say("<p>hello,world</p>")';}}}WAFdemolocation/{access_by_lua'localua=ngx.var.http_user_agentlocalip=ngx.var.remote_addrifngx.re.find(ua,"spider","i")andngx.re.find(ip,"12.34|56.78","i")thenngx.exit(403)end}NginxNginxngx_lua_moduleNginx,,OpenRestyOpenResty之間的關(guān)系OpenRestyNgxNgx_Lua_ModuleNginxAPI多個(gè)Nginx模塊EchoNginxModuleHeaderMoreNginxModuleAuthRequetNginxModule…rykLibraryLuaRestyMemcachedLibrary…lokeulokeueeeqJavaScriptUpStreamwithoutcookiesJavascriptwithJavaScriptUpStreamwithoutcookiesJavascriptwithcookiesUpStreamNginxUpStreamVerifyToken驗(yàn)證洲覽器特驗(yàn)證洲覽器特征SetCookiesClientJavascriptRuntimeReturnReturnJavasc