使用openresty通过lua修改请求/响应头

╰+哭是因爲堅強的太久メ 2023-07-25 14:14 19阅读 0赞

## openresty介绍 ##

在使用nginx时，如果我们想进行开发，开发难度比较大，openresty对nginx核心集成了很多lua三方模块，开发者可以使用lua脚本进行开发，开发者只需了解http协议和lua脚本。openresty你可以理解为支持lua开发的nginx,但是性能比nginx强。

openresty可提供：均衡负载、请求路由、安全认证、服务鉴权、流量控制、日志监控服务等。

根据openresty官网提供的数据表明：openresty在单机上就可以支持1万~100万并发连接。

### mac安装oepnresty ###

#### 安装 ####

// 使用brew 安装 
      brew install openresty/brew/openresty
    
    
    // 上面安装完后，执行nginx 提示找不到命令
    // 配置环境变量(会话级,关闭这个会话，变量失效)
    export PATH = /usr/local/opt/openresty/nginx/sbin:$PATH

安装完成后

// 启动
    sudo nginx -c /usr/local/etc/openresty/nginx/nginx.conf
    // 重载配置文件
    sudo nginx -s reload -c /usr/local/etc/openresty/nginx/nginx.conf
    //检查配置文件语法
    sudo nginx -t /usr/local/etc/openresty/nginx/nginx.conf
    // 停止
    sudo nginx -s stop

#### 卸载 ####

// brew 卸载openresty
    brew uninstall --force openresty/brew/openresty

### linux安装openresty ###

// 安装依赖库
    apt-get install libreadline-dev libpcre3-dev libssl-dev perl
    // 下载
    wget https://openresty.org/download/ngx_openresty-1.9.7.1.tar.gz  
    // 解压
    tar xzvf ngx_openresty-1.9.7.1.tar.gz       
    //进入解压后的目录
    cd ngx_openresty-1.9.7.1/ 
    // 安装
    ./configure
    make 
    make install

默认情况下程序会被安装到 **/usr/local/openresty**, 你可以使用./configure --help查看会更多的配置选项

## openresty的lua时序图 ##

![逻辑图][format_png]

### init\_by\_lua ###

*  用法  
    当启动nginx的master进程加载配置文件时可以执行init\_by\_lua这里定义的lua脚本。
 *  语法

init_by_lua  <lua-script-str>

*  示例

// nginx.conf
    location / { 
    init_by_lua 'your code';
    }

*  init\_by\_lua\_block语法

init_by_lua_block {  lua-script }

*  init\_by\_lua\_file语法

init_by_lua_file  <path-lua-script>

### init\_worker\_by\_lua ###

*  用法  
    当nginx的master进程启动后，每一个woker进程启动时执行这里定义的脚本。
 *  语法

init_worker_by_lua <lua-script-str>

*  示例

// nginx.conf
    location / { 
    init_worker_by_lua  'your code';
    }

*  init\_worker\_by\_lua\_block语法

init_worker_by_lua_block {  lua-script}

*  init\_worker\_by\_lua\_file语法

init_worker_by_lua_file <lua-file-path>

### set\_by\_lua ###

*  用法  
    执行指定脚本和输入的值返回一个结果
 *  语法

set_by_lua $res <lua-script-str> [$arg1 $arg2...]

*  示例

location /foo { 
     set $diff ''; # we have to predefine the $diff variable here
     set_by_lua $sum '
         local a = 32
         local b = 56
         ngx.var.diff = a - b;  -- write to $diff directly
         return a + b;          -- return the $sum value normally
     ';
     echo "sum = $sum, diff = $diff";
     }

*  set\_by\_lua\_block语法

set_by_lua_block $res [lua-script]

*  set\_by\_lua\_file语法

set_by_lua-file $res <path-to-lua-script-file> [$arg1 $arg2...]

### rewite\_by\_lua ###

*  用法  
    执行Lua脚本重写每一个请求，注意这个处理器的时序必须在标准的 **ngx\_http\_rewrite\_module**模块之后执行。
 *  语法

rewrite_by_lua <lua-script-styr>

*  示例
    
    正确执行

location /foo { 
     set $a 12; # create and initialize $a
     set $b ""; # create and initialize $b
     rewrite_by_lua 'ngx.var.b = tonumber(ngx.var.a) + 1';
     echo "res = $b";
     }

没有按照期望执行

location /foo { 
     ?      set $a 12; # create and initialize $a
     ?      set $b ''; # create and initialize $b
     ?      rewrite_by_lua 'ngx.var.b = tonumber(ngx.var.a) + 1';
     ?      if ($b = '13') { 
     ?         rewrite ^ /bar redirect;
     ?         break;
     ?      }
     ?
     ?      echo "res = $b";
     ?  }

因为 **if** 运行在 **rewrite\_by\_lua**之前即使代码看起在其后执行.

*  rewrite\_by\_lua\_block语法

rewrite_by_lua_block {lua-script}

*  rewrite\_by\_lua\_file语法

rewrite_by_lua_file <path-to-lua-script-file>

### access\_by\_lua ###

*  用法  
    执行Lua脚本可以修改每一个请求头，注意这个处理器的时序必须在标准的 **ngx\_http\_access\_module**模块之后执行。
 *  语法

access_by_lua <lua-script-str>

*  示例

location / { 
     deny    192.168.1.1;
     allow   192.168.1.0/24;
     allow   10.1.1.0/16;
     deny    all;
    
     access_by_lua ' local res = ngx.location.capture("/mysql", { ... }) ... ';
    
     # proxy_pass/fastcgi_pass/...
     }

*  access\_by\_lua\_block语法

access_by_lua_block {lua-script}

*  access\_by\_lua\_file语法

// 如果写相对地址，相对于nginx根目录
    acess_by_lua_file <path-to-lua-script-file>
    // 这里地址推荐使用绝对地址

### header\_filter\_by\_lua ###

*  用法

执行Lua脚本修改每一个请求的响应头信息

*  语法

header_filter_by_lua <lua-script-str>

*  示例

location / { 
     proxy_pass http://mybackend;
     header_filter_by_lua 'ngx.header.Foo = "blah"';
     }

*  header\_filter\_by\_lua\_block语法

header_filter_by_lua_block {lus-script}

*  header\_filter\_by\_lua\_file语法

header_filter_by_lua_file <path-to-lua-script-file>

### body\_filter\_by\_lua ###

*  用法  
    执行Lua脚本修改每一个请求的响应body信息
 *  语法

body_filter_by_lua <lua-script-str>

*  示例

location / { 
     proxy_pass http://mybackend;
     body_filter_by_lua 'ngx.arg[1] = string.upper(ngx.arg[1])';
     }

*  body\_filter\_by\_lua\_block语法

body_filter_by_lua_block {lua-script-str}

*  body\_filter\_by\_lua\_file语法

body_filter_by_lua_file <path-to-lua-script-file>

## 修改请求头 ##

如果请求头有 **authorization**并且他的值包含Bearer,则重写值,我们这里使用**access\_by\_lua\_file**

nignx.conf

location / { 
            access_by_lua_file lua/changeReqHeader.lua;
        }

changeReqHeader.lua

-- 重写请求头 token
    -- 如果请求头包含 authorization 并且内容包含  Bearer，则重写请求头
    local token = '123456'
    if  ngx.req.get_headers()["authorization"] ~= nil and string.find(ngx.req.get_headers()["authorization"], 'Bearer') ~= nil then
      ngx.req.set_header("authorization", "Bearer "..token)
    -- ngx.log(ngx.ERR, "token:"..token)
    end

## 修改响应头 ##

如果响应码时401，响应头有authenticate,则修改这个值,我们这里使用 **header\_filter\_by\_lua\_file**

nignx.conf

location / { 
               header_filter_by_lua_file lua/changeRrespHeader.lua;
        }

changeRrespHeader.lua

if ngx.status == 401 then
    local h = ngx.resp.get_headers()
    for k, v in pairs(h) do
        if k == "www-authenticate" then
            ngx.header["www-authenticate"] = "Bearer realm=\"http://xxx-xxx.com.cn/service/token\",service=\"harbor-registry\""
        end
    end
    end

## nginx提供给lua的API ##

在lua脚本中可以使用下面的API进行开发。

### http方法 ###

上下文使用lua时序方法 init\_by\_lua\*, set\_by\_lua\*, rewrite\_by\_lua\*, access\_by\_lua\*, content\_by\_lua\*, header\_filter\_by\_lua\*, body\_filter\_by\_lua\*, log\_by\_lua\*, ngx.timer.*, balancer\_by\_lua*, ssl\_certificate\_by\_lua\*, ssl\_session\_fetch\_by\_lua\*, ssl\_session\_store\_by\_lua\*

ngx.HTTP_GET
      ngx.HTTP_HEAD
      ngx.HTTP_PUT
      ngx.HTTP_POST
      ngx.HTTP_DELETE

### http状态码 ###

上下文使用Lua时序方法init\_by\_lua\*, set\_by\_lua\*, rewrite\_by\_lua\*, access\_by\_lua\*, content\_by\_lua\*, header\_filter\_by\_lua\*, body\_filter\_by\_lua\*, log\_by\_lua\*, ngx.timer.*, balancer\_by\_lua*, ssl\_certificate\_by\_lua\*, ssl\_session\_fetch\_by\_lua\*, ssl\_session\_store\_by\_lua\*

value = ngx.HTTP_CONTINUE (100) (first added in the v0.9.20 release)
       value = ngx.HTTP_SWITCHING_PROTOCOLS (101) (first added in the v0.9.20 release)
       value = ngx.HTTP_OK (200)
       value = ngx.HTTP_CREATED (201)
       value = ngx.HTTP_ACCEPTED (202) (first added in the v0.9.20 release)
       value = ngx.HTTP_NO_CONTENT (204) (first added in the v0.9.20 release)
       value = ngx.HTTP_PARTIAL_CONTENT (206) (first added in the v0.9.20 release)
       value = ngx.HTTP_SPECIAL_RESPONSE (300)
       value = ngx.HTTP_MOVED_PERMANENTLY (301)
       value = ngx.HTTP_MOVED_TEMPORARILY (302)
       value = ngx.HTTP_SEE_OTHER (303)
       value = ngx.HTTP_NOT_MODIFIED (304)
       value = ngx.HTTP_TEMPORARY_REDIRECT (307) (first added in the v0.9.20 release)
       value = ngx.HTTP_PERMANENT_REDIRECT (308)
       value = ngx.HTTP_BAD_REQUEST (400)
       value = ngx.HTTP_UNAUTHORIZED (401)
       value = ngx.HTTP_PAYMENT_REQUIRED (402) (first added in the v0.9.20 release)
       value = ngx.HTTP_FORBIDDEN (403)
       value = ngx.HTTP_NOT_FOUND (404)
       value = ngx.HTTP_NOT_ALLOWED (405)
       value = ngx.HTTP_NOT_ACCEPTABLE (406) (first added in the v0.9.20 release)
       value = ngx.HTTP_REQUEST_TIMEOUT (408) (first added in the v0.9.20 release)
       value = ngx.HTTP_CONFLICT (409) (first added in the v0.9.20 release)
       value = ngx.HTTP_GONE (410)
       value = ngx.HTTP_UPGRADE_REQUIRED (426) (first added in the v0.9.20 release)
       value = ngx.HTTP_TOO_MANY_REQUESTS (429) (first added in the v0.9.20 release)
       value = ngx.HTTP_CLOSE (444) (first added in the v0.9.20 release)
       value = ngx.HTTP_ILLEGAL (451) (first added in the v0.9.20 release)
       value = ngx.HTTP_INTERNAL_SERVER_ERROR (500)
       value = ngx.HTTP_METHOD_NOT_IMPLEMENTED (501)
       value = ngx.HTTP_BAD_GATEWAY (502) (first added in the v0.9.20 release)
       value = ngx.HTTP_SERVICE_UNAVAILABLE (503)
       value = ngx.HTTP_GATEWAY_TIMEOUT (504) (first added in the v0.3.1rc38 release)
       value = ngx.HTTP_VERSION_NOT_SUPPORTED (505) (first added in the v0.9.20 release)
       value = ngx.HTTP_INSUFFICIENT_STORAGE (507) (first added in the v0.9.20 release)

### 删除nginx日志级别 ###

上下文使用Lua时序方法init\_by\_lua\*, init\_worker\_by\_lua\*, set\_by\_lua\*, rewrite\_by\_lua\*, access\_by\_lua\*, content\_by\_lua\*, header\_filter\_by\_lua\*, body\_filter\_by\_lua\*, log\_by\_lua\*, ngx.timer.*, balancer\_by\_lua*, ssl\_certificate\_by\_lua\*, ssl\_session\_fetch\_by\_lua\*, ssl\_session\_store\_by\_lua\*

//使用 ngx.log（level,  output info）

ngx.STDERR
       ngx.EMERG
       ngx.ALERT
       ngx.CRIT
       ngx.ERR
       ngx.WARN
       ngx.NOTICE
       ngx.INFO
       ngx.DEBUG

### 本次请求发起子请求 ngx.location.capture ###

local  res = ngx.location.capture('/foo/bar?a=3&b=4')
    // 子请求响应码不等于200
    if res.status ~= 200 then
    ngx.log(ngx.ERR, "sub request returned bad status: ",
    res.status)
    //父请求返回非200，整个请求结束
    ngx.exit(res.status)
    end

### 读写当前请求的响应码 ngx.status ###

上下文使用Lua时序方法set\_by\_lua\*, rewrite\_by\_lua\*, access\_by\_lua\*, content\_by\_lua\*, header\_filter\_by\_lua\*, body\_filter\_by\_lua\*, log\_by\_lua\*

//在Lua中使用当前请求响应码
    local status = ngx.status

### 设置请求的响应头 ngx.header.HEADER ###

**注意这个是响应头 response header**

//注意在lua字符串中 \" 代表一个双引号符号，\' 代表一个单引号(撇号)字符
    ngx.header["www-authenticate"] ="Bearer realm=\"http://xxx.paic.com.cn:8443/service/token\",service=\"harbor-registry\""

### 得到响应的所有头 ngx.resp.get\_headers ###

上下文Lua时序方法 set\_by\_lua\*, rewrite\_by\_lua\*, access\_by\_lua\*, content\_by\_lua\*, header\_filter\_by\_lua\*, body\_filter\_by\_lua\*, log\_by\_lua\*, balancer\_by\_lua\*

if ngx.status == 401 then
    local h = ngx.resp.get_headers()
    for k, v in pairs(h) do
        if k == "www-authenticate" then
            ngx.header["www-authenticate"] = "Bearer realm=12121"
        end
    end
    end

local value = ngx.resp.get_headers()["header name"]

### 得到请求的所有头 ngx.req.get\_headers ###

上下文lua时序方法set\_by\_lua\*, rewrite\_by\_lua\*, access\_by\_lua\*, content\_by\_lua\*, header\_filter\_by\_lua\*, body\_filter\_by\_lua\*, log\_by\_lua\*

local h = ngx.req.get_headers()
    for k, v in pairs(h) do
        if k == "authorization" then
            ngx.req_set_header("authorization", "basic 1233")
        end
    end

local value = ngx.req.get_headers()["authorization"]

### 设置请求头信息 ngx.req.set\_header ###

上下文Lua时序方法set\_by\_lua\*, rewrite\_by\_lua\*, access\_by\_lua\*, content\_by\_lua\*, header\_filter\_by\_lua\*, body\_filter\_by\_lua\*

ngx.req_set_header("authorization", "basic 1233")

## 上传文件nginx报http 413错误 ##

报413错误原因是请求实体太大，nginx的缓存区设置的太小，

http { 
    // 允许用户最大上传数据限制，默认1M，位置可放在http,server,location
    client_max_body_size 500M;
    client_body_filter_size 200M;
    }

## nginx中文日志乱码 ##

nginx配置文件log\_format增加 escape参数，json或者none都可以。

log_format  main escape=json  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

## 参考 ##

[openresty官方][openresty]

[openresty实战：概念和应用场景][openresty 1]

[浅析openresty][openresty 2]

[openrestry相关lua解释][openrestry_lua]

[lua简单教程][lua]

[nginx 401处理][nginx 401]

[format_png]: /images/20230528/1e0522f861a34a379ccc511cfc7e7dd8.png
[openresty]: http://openresty.org/en/
[openresty 1]: https://blog.csdn.net/u014079773/article/details/101421663
[openresty 2]: https://blog.csdn.net/yhclt/article/details/79309237
[openrestry_lua]: https://github.com/openresty/lua-nginx-module#init_by_lua
[lua]: https://www.runoob.com/lua/lua-strings.html
[nginx 401]: https://blog.csdn.net/qq_38630637/article/details/84652613