Nginx反向代理WebSockets安全配置指南

WebSockets通过Nginx反向代理时需要特别注意安全性配置，以下是全面的安全建议和配置方案。

基础安全配置

1. 升级连接协议

location /websocket/ {
    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

2. 限制WebSocket端点

# 只允许特定路径的WebSocket连接
location = /ws-endpoint {
    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

# 拒绝其他WebSocket尝试
location / {
    if ($http_upgrade = "websocket") {
        return 403;
    }
    # 其他代理配置
}

高级安全措施

3. 请求验证

location /ws-endpoint {
    # 验证Origin头
    if ($http_origin !~* (https://example.com|https://sub.example.com)) {
        return 403;
    }

    # 验证WebSocket协议头
    if ($http_upgrade != "websocket") {
        return 400;
    }

    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Origin $http_origin;
}

4. 速率限制

limit_req_zone $binary_remote_addr zone=wslimit:10m rate=10r/s;

location /ws-endpoint {
    limit_req zone=wslimit burst=20;

    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}

5. TLS安全配置

server {
    listen 443 ssl;
    server_name example.com;

    # 现代TLS配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    # WebSocket配置
    location /ws-endpoint {
        proxy_pass http://backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

监控和日志

log_format websocket '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $body_bytes_sent '
                     '"$http_referer" "$http_user_agent" "$http_upgrade"';

server {
    access_log /var/log/nginx/websocket.log websocket;

    location /ws-endpoint {
        # ...其他配置...
    }
}

其他安全建议

1. IP限制：只允许特定IP访问WebSocket端点

   allow 192.168.1.0/24;
   allow 10.0.0.1;
   deny all;
   

2. 认证：在应用层实现WebSocket连接认证

3. 消息验证：在应用代码中验证所有WebSocket消息

4. 超时设置：配置合理的超时时间

   proxy_connect_timeout 7d;
   proxy_send_timeout 7d;
   proxy_read_timeout 7d;
   

5. 缓冲区限制：防止内存耗尽攻击

   proxy_buffer_size 16k;
   proxy_buffers 4 32k;
   proxy_busy_buffers_size 64k;
   

通过以上配置，可以显著提高Nginx反向代理WebSocket连接的安全性。请根据您的具体需求调整这些配置。