symfony - 在 vhost 或 security.yml/routing.yml 中强制使用 SSL 时无限循环

标签 symfony ssl nginx https

我正在使用 Symphony 2.6 和 Nginx 1.4。这个问题已经被问过好几次了，但所有提供的答案或解决方案都不适合我。

我希望 New Linux Counter Project 完全仅支持 SSL，但无论我是在 nginx 的 vhost 文件中设置重定向到端口 443，还是将 required_channel https 添加到 security.yml 或添加 [https ] 到 routing.yml，访问页面时一切都会导致无限循环。

不过，SSL 可以正常工作。当从 vhost 文件中删除所有重定向并从 security.yml 和 routing.yml 中删除 https 内容时，一切正常，您可以访问例如:https://www.linuxcounter.net/login没有任何问题。

这是没有强制 SSL 的 vhost 文件:

server {
    listen 80;
    server_name www.linuxcounter.net api.linuxcounter.net linuxcounter.net;
    root /srv/www.linuxcounter.net/web;

    client_max_body_size 128M;

    location ~ ^/update\.php(/|$) {
        root /srv/www.linuxcounter.net/web;
        fastcgi_pass php;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS off;
    }

    location / {
        try_files $uri /app.php$is_args$args;
    }

    location ~* ^/user/([0-9]+)\.html$ {
        root /srv/www.linuxcounter.net/web;
        rewrite /user/([0-9]+)\.html /user/$1 last;
        internal;
    }

    location ~* /(cert|mcert)/[0-9]+\.png$ {
    root /srv/www.linuxcounter.net/web;
        rewrite /(cert|mcert)/[0-9]+\.png /app.php last;
    expires -1;
    add_header Cache-Control private;
    }

    location ~ ^/app\.php(/|$) {
        fastcgi_pass php;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS off;
    internal;
    }

    location ~* \.(js|jpg|png|css)$ {
        root /srv/www.linuxcounter.net/web;
        expires 30d;
    }

    error_log /LOGS/www.linuxcounter.net_error_log;
    access_log /LOGS/www.linuxcounter.net_access_log;
}

server {
    listen 443 default;
    server_name www.linuxcounter.net api.linuxcounter.net linuxcounter.net;
    root /srv/www.linuxcounter.net/web;

    client_max_body_size 128M;

    ssl                     on;
    ssl_certificate         /etc/nginx/ssl/2015-04-02-www.linuxcounter.net-cert-bundle.crt;
    ssl_certificate_key     /etc/nginx/ssl/2015-04-02-www.linuxcounter.net.key;

    ssl_session_timeout  5m;

    ssl_protocols SSLv3 TLSv1;
    ssl_ciphers  RC4:HIGH:!aNULL:!MD5:!kEDH;
    ssl_prefer_server_ciphers   on;

    location ~ ^/update\.php(/|$) {
        root /srv/www.linuxcounter.net/web;
        fastcgi_pass php;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS on;
    }

    location / {
        try_files $uri /app.php$is_args$args;
    }

    location ~* /(cert|mcert)/[0-9]+\.png$ {
        root /srv/www.linuxcounter.net/web;
        rewrite /(cert|mcert)/[0-9]+\.png /app.php last;
        expires -1;
        add_header Cache-Control private;
    }

    location ~ ^/app\.php(/|$) {
        fastcgi_pass php;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS on;
        internal;
    }

    location ~* \.(js|jpg|png|css)$ {
        root /srv/www.linuxcounter.net/web;
        expires 30d;
    }

    error_log /LOGS/www.linuxcounter.net_error_log;
    access_log /LOGS/www.linuxcounter.net_access_log;
}

这是强制使用 SSL 的虚拟主机文件:

server {
    listen 80;
    server_name www.linuxcounter.net api.linuxcounter.net linuxcounter.net;
    root /srv/www.linuxcounter.net/web;
    return 301 https://www.linuxcounter.net$request_uri;
}

server {
    listen 443 ssl;
    server_name www.linuxcounter.net api.linuxcounter.net linuxcounter.net;
    root /srv/www.linuxcounter.net/web;

    client_max_body_size 512M;

    # ssl                     on;
    ssl_certificate         /etc/nginx/ssl/2015-04-02-www.linuxcounter.net-cert-bundle.crt;
    ssl_certificate_key     /etc/nginx/ssl/2015-04-02-www.linuxcounter.net.key;

    ssl_session_timeout  5m;
    ssl_protocols SSLv3 TLSv1;
    ssl_ciphers  RC4:HIGH:!aNULL:!MD5:!kEDH;
    ssl_prefer_server_ciphers   on;

    location ~ ^/update\.php(/|$) {
        root /srv/www.linuxcounter.net/web;
        fastcgi_pass php;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS on;
    }

    location / {
        try_files $uri /app.php$is_args$args;
    }

    location ~* /(cert|mcert)/[0-9]+\.png$ {
        root /srv/www.linuxcounter.net/web;
        rewrite /(cert|mcert)/[0-9]+\.png /app.php last;
        expires -1;
        add_header Cache-Control private;
    }

    location ~ ^/app\.php(/|$) {
        fastcgi_pass php;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS on;
        internal;
    }

    location ~* \.(js|jpg|png|css)$ {
        root /srv/www.linuxcounter.net/web;
        expires 30d;
    }

    error_log /LOGS/www.linuxcounter.net_error_log;
    access_log /LOGS/www.linuxcounter.net_access_log;
}

一旦我将 vhost 文件替换为在端口 80 上重定向到 SSL 的文件，我就会在所有页面、链接或路由上得到无限循环。

所以当浏览到https://www.linuxcounter.net/login时, 然后/login 重新加载 301 重定向 15 或 20 次，直到出现无限循环的错误消息。

但是对于第一个 vhost 文件，整个页面都可以毫无问题地使用 https://。

这是我的 routing.yml:

syw_front_main:
    resource: "@SywFrontMainBundle/Controller/"
    type:     annotation
    prefix:   /
    host:     %base_host%

fos_user:
    resource: "@FOSUserBundle/Resources/config/routing/all.xml"
    host:     %base_host%

easy_admin_bundle:
    resource: "@EasyAdminBundle/Controller/"
    type:     annotation
    prefix:   /admin
    host:     %base_host%

shtumi_useful:
    resource: '@ShtumiUsefulBundle/Resources/config/routing.xml'
    host:     %base_host%

blade_tester_light_news_bundle:
    resource: "@BladeTesterLightNewsBundle/Resources/config/routing.yml"
    prefix:   /news
    host:     %base_host%

syw_front_api:
    resource: "@SywFrontApiBundle/Controller/"
    type:     annotation
    prefix:   /
    host:     %api_host%

这是我的 security.yml:

# you can read more about security in the related section of the documentation
# http://symfony.com/doc/current/book/security.html
security:
    # http://symfony.com/doc/current/book/security.html#encoding-the-user-s-password
    encoders:
        FOS\UserBundle\Model\UserInterface: sha512

    # http://symfony.com/doc/current/book/security.html#hierarchical-roles
    role_hierarchy:
        ROLE_ADMIN:       ROLE_USER
        ROLE_SUPER_ADMIN: [ROLE_USER, ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]

    # http://symfony.com/doc/current/book/security.html#where-do-users-come-from-user-providers
    providers:
        fos_userbundle:
            id: fos_user.user_provider.username_email
        # in_memory:
        #     memory:
        #         users:
        #             user:  { password: userpass, roles: [ 'ROLE_USER' ] }
        #             admin: { password: adminpass, roles: [ 'ROLE_ADMIN' ] }

    # the main part of the security, where you can set up firewalls
    # for specific sections of your app
    firewalls:
        main:
            pattern: ^/
            form_login:
                provider: fos_userbundle
                csrf_provider: form.csrf_provider
            logout:       true
            anonymous:    true
            form_login:
                # login success redirecting options (read further below)
                always_use_default_target_path: false
                default_target_path:            fos_user_profile_show
                use_referer:                    true
        # disables authentication for assets and the profiler, adapt it according to your needs
        dev:
            pattern:  ^/(_(profiler|wdt)|css|images|js)/
            security: false
            form_login:
                # login success redirecting options (read further below)
                always_use_default_target_path: false
                default_target_path:            fos_user_profile_show
                use_referer:                    true

    # with these settings you can restrict or allow access for different parts
    # of your application based on roles, ip, host or methods
    # http://symfony.com/doc/current/cookbook/security/access_control.html
    access_control:
        - { path: ^/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: /admin, role: ROLE_ADMIN }

对我来说一切似乎都很安静......

但我没有让它工作。

那么，我想要的是:

如果有人访问 http://*linuxcounter.net，那么他应该用 301 重定向到 https://*linuxcounter.net

最佳答案

好吧...经过几个小时的尝试和测试，我现在找到了一个不是很理想但很有效的解决方案。

我现在只是在 Symfony 的/app.php 顶部做一个重定向:

if ($_SERVER["HTTP_X_FORWARDED_PROTO"] == "http") {
    $redir = "Location: https://www.linuxcounter.net" . $_SERVER["REQUEST_URI"];
    header($redir);
    exit();
}

这有效并且不会产生任何无限循环。

关于symfony - 在 vhost 或 security.yml/routing.yml 中强制使用 SSL 时无限循环，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/29684630/

上一篇：node.js - NodeJS 和 NginX 的 SocketIO 连接错误

下一篇：java - 使用 SSLContext 创建 SocketChannel

相关文章：

symfony - 加载开发、生产和测试环境的 bundle 特定值

ssl - 无法使用 openssl 从 cer 文件创建 pfx 文件

Python 错误 SSL : ssl. SSLError : [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl. c:726)

nginx - 在带有 rtmp 模块的 nginx 中使用时，工作 ffmpeg 命令失败

ubuntu - 如何获取 nginx 使用的当前 worker 连接？

php - 无需用户身份验证的开发环境的 Symfony http 基本身份验证

php - 从 Doctrine2 获取值数组的正确方法

rest - 本地 IP 地址的 HTTPS

php - 关于如何调整 Web 应用程序的性能有什么好主意吗？

symfony - 使用 EntityType 显示选择时，无法从 Symfony 表单保存实体

©2024 IT工具网  联系我们