后端面试必备：使用Nginx实现反向代理时如何配置将客户端信息传递给后端服务器

Nginx面试题 – 使用Nginx实现反向代理时，如何配置将客户端信息传递给后端服务器？

回答重点

要在使用Nginx实现反向代理时，将客户端信息（如IP地址）传递给后端服务器，通常需要在Nginx配置文件中添加以下内容：

proxy_set_header X-Forwarded-For $remote_addr;

proxy_set_header Host $host;

proxy_set_header User-Agent $http_user_agent;

一个示例配置如下：

server {
listen 80;
server_name example.com;

location / {
proxy_pass http://backend_server;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}

引言

在现代Web架构中，反向代理已成为不可或缺的组件。Nginx作为高性能的反向代理服务器，不仅能够负载均衡、缓存内容，还能在代理请求时传递关键的客户端信息给后端服务器。本文将详细介绍如何在Nginx反向代理配置中传递客户端真实IP、协议、端口等信息给后端应用服务器。

为什么需要传递客户端信息

#mermaid-svg-fBqQowmNFWuFTEJ9 {font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}#mermaid-svg-fBqQowmNFWuFTEJ9 .error-icon{fill:#552222;}#mermaid-svg-fBqQowmNFWuFTEJ9 .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-fBqQowmNFWuFTEJ9 .edge-thickness-normal{stroke-width:2px;}#mermaid-svg-fBqQowmNFWuFTEJ9 .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-fBqQowmNFWuFTEJ9 .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-fBqQowmNFWuFTEJ9 .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-fBqQowmNFWuFTEJ9 .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-fBqQowmNFWuFTEJ9 .marker{fill:#333333;stroke:#333333;}#mermaid-svg-fBqQowmNFWuFTEJ9 .marker.cross{stroke:#333333;}#mermaid-svg-fBqQowmNFWuFTEJ9 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-fBqQowmNFWuFTEJ9 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-fBqQowmNFWuFTEJ9 .cluster-label text{fill:#333;}#mermaid-svg-fBqQowmNFWuFTEJ9 .cluster-label span{color:#333;}#mermaid-svg-fBqQowmNFWuFTEJ9 .label text,#mermaid-svg-fBqQowmNFWuFTEJ9 span{fill:#333;color:#333;}#mermaid-svg-fBqQowmNFWuFTEJ9 .node rect,#mermaid-svg-fBqQowmNFWuFTEJ9 .node circle,#mermaid-svg-fBqQowmNFWuFTEJ9 .node ellipse,#mermaid-svg-fBqQowmNFWuFTEJ9 .node polygon,#mermaid-svg-fBqQowmNFWuFTEJ9 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-fBqQowmNFWuFTEJ9 .node .label{text-align:center;}#mermaid-svg-fBqQowmNFWuFTEJ9 .node.clickable{cursor:pointer;}#mermaid-svg-fBqQowmNFWuFTEJ9 .arrowheadPath{fill:#333333;}#mermaid-svg-fBqQowmNFWuFTEJ9 .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-fBqQowmNFWuFTEJ9 .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-fBqQowmNFWuFTEJ9 .edgeLabel{background-color:#e8e8e8;text-align:center;}#mermaid-svg-fBqQowmNFWuFTEJ9 .edgeLabel rect{opacity:0.5;background-color:#e8e8e8;fill:#e8e8e8;}#mermaid-svg-fBqQowmNFWuFTEJ9 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-fBqQowmNFWuFTEJ9 .cluster text{fill:#333;}#mermaid-svg-fBqQowmNFWuFTEJ9 .cluster span{color:#333;}#mermaid-svg-fBqQowmNFWuFTEJ9 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-fBqQowmNFWuFTEJ9 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

请求

代理请求

响应

响应

客户端

Nginx反向代理

后端服务器

如上图所示，当使用反向代理架构时，后端服务器默认只能看到Nginx服务器的IP地址，而无法获取原始客户端的真实信息。这会导致以下问题：

核心配置指令

1. 传递客户端真实IP

最常用的配置是通过X-Forwarded-For和X-Real-IP头部传递客户端IP：

location / {
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://backend_server;
}

• $remote_addr：客户端真实IP地址
• $proxy_add_x_forwarded_for：将当前客户端IP追加到现有的X-Forwarded-For头部

#mermaid-svg-4Ehxen9JvMsll0ok {font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}#mermaid-svg-4Ehxen9JvMsll0ok .error-icon{fill:#552222;}#mermaid-svg-4Ehxen9JvMsll0ok .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-4Ehxen9JvMsll0ok .edge-thickness-normal{stroke-width:2px;}#mermaid-svg-4Ehxen9JvMsll0ok .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-4Ehxen9JvMsll0ok .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-4Ehxen9JvMsll0ok .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-4Ehxen9JvMsll0ok .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-4Ehxen9JvMsll0ok .marker{fill:#333333;stroke:#333333;}#mermaid-svg-4Ehxen9JvMsll0ok .marker.cross{stroke:#333333;}#mermaid-svg-4Ehxen9JvMsll0ok svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-4Ehxen9JvMsll0ok .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-4Ehxen9JvMsll0ok .cluster-label text{fill:#333;}#mermaid-svg-4Ehxen9JvMsll0ok .cluster-label span{color:#333;}#mermaid-svg-4Ehxen9JvMsll0ok .label text,#mermaid-svg-4Ehxen9JvMsll0ok span{fill:#333;color:#333;}#mermaid-svg-4Ehxen9JvMsll0ok .node rect,#mermaid-svg-4Ehxen9JvMsll0ok .node circle,#mermaid-svg-4Ehxen9JvMsll0ok .node ellipse,#mermaid-svg-4Ehxen9JvMsll0ok .node polygon,#mermaid-svg-4Ehxen9JvMsll0ok .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-4Ehxen9JvMsll0ok .node .label{text-align:center;}#mermaid-svg-4Ehxen9JvMsll0ok .node.clickable{cursor:pointer;}#mermaid-svg-4Ehxen9JvMsll0ok .arrowheadPath{fill:#333333;}#mermaid-svg-4Ehxen9JvMsll0ok .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-4Ehxen9JvMsll0ok .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-4Ehxen9JvMsll0ok .edgeLabel{background-color:#e8e8e8;text-align:center;}#mermaid-svg-4Ehxen9JvMsll0ok .edgeLabel rect{opacity:0.5;background-color:#e8e8e8;fill:#e8e8e8;}#mermaid-svg-4Ehxen9JvMsll0ok .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-4Ehxen9JvMsll0ok .cluster text{fill:#333;}#mermaid-svg-4Ehxen9JvMsll0ok .cluster span{color:#333;}#mermaid-svg-4Ehxen9JvMsll0ok div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-4Ehxen9JvMsll0ok :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

X-Forwarded-For: 203.0.113.1

X-Forwarded-For: 203.0.113.1, 192.168.1.10X-Real-IP: 203.0.113.1

Client

Nginx

Backend

2. 传递协议信息

当Nginx处理HTTPS请求并代理到后端HTTP服务时，需要传递原始协议信息：

location / {
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://backend_server;
}

• $scheme：请求协议（http或https）

3. 传递主机头和端口信息

location / {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_pass http://backend_server;
}

• $host：原始请求的主机名
• $server_port：服务器端口号

完整配置示例

server {
listen 80;
server_name example.com;

location / {
proxy_pass http://backend_server;

# 传递客户端信息
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Port $server_port;

# 其他代理设置
proxy_redirect off;
proxy_connect_timeout 60s;
proxy_read_timeout 60s;
}
}

后端服务器如何读取这些信息

不同编程语言的后端服务器有不同的读取方式：

PHP示例

$realIp = $_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR'];
$forwardedFor = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? '';
$protocol = $_SERVER['HTTP_X_FORWARDED_PROTO'] ?? 'http';

Node.js示例

const realIp = req.headers['x-real-ip'] || req.connection.remoteAddress;
const forwardedFor = req.headers['x-forwarded-for'] || '';
const protocol = req.headers['x-forwarded-proto'] || 'http';

安全注意事项

#mermaid-svg-PZ8yiR8TNUiMOYOg {font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}#mermaid-svg-PZ8yiR8TNUiMOYOg .error-icon{fill:#552222;}#mermaid-svg-PZ8yiR8TNUiMOYOg .error-text{fill:#552222;stroke:#552222;}#mermaid-svg-PZ8yiR8TNUiMOYOg .edge-thickness-normal{stroke-width:2px;}#mermaid-svg-PZ8yiR8TNUiMOYOg .edge-thickness-thick{stroke-width:3.5px;}#mermaid-svg-PZ8yiR8TNUiMOYOg .edge-pattern-solid{stroke-dasharray:0;}#mermaid-svg-PZ8yiR8TNUiMOYOg .edge-pattern-dashed{stroke-dasharray:3;}#mermaid-svg-PZ8yiR8TNUiMOYOg .edge-pattern-dotted{stroke-dasharray:2;}#mermaid-svg-PZ8yiR8TNUiMOYOg .marker{fill:#333333;stroke:#333333;}#mermaid-svg-PZ8yiR8TNUiMOYOg .marker.cross{stroke:#333333;}#mermaid-svg-PZ8yiR8TNUiMOYOg svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#mermaid-svg-PZ8yiR8TNUiMOYOg .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#mermaid-svg-PZ8yiR8TNUiMOYOg .cluster-label text{fill:#333;}#mermaid-svg-PZ8yiR8TNUiMOYOg .cluster-label span{color:#333;}#mermaid-svg-PZ8yiR8TNUiMOYOg .label text,#mermaid-svg-PZ8yiR8TNUiMOYOg span{fill:#333;color:#333;}#mermaid-svg-PZ8yiR8TNUiMOYOg .node rect,#mermaid-svg-PZ8yiR8TNUiMOYOg .node circle,#mermaid-svg-PZ8yiR8TNUiMOYOg .node ellipse,#mermaid-svg-PZ8yiR8TNUiMOYOg .node polygon,#mermaid-svg-PZ8yiR8TNUiMOYOg .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#mermaid-svg-PZ8yiR8TNUiMOYOg .node .label{text-align:center;}#mermaid-svg-PZ8yiR8TNUiMOYOg .node.clickable{cursor:pointer;}#mermaid-svg-PZ8yiR8TNUiMOYOg .arrowheadPath{fill:#333333;}#mermaid-svg-PZ8yiR8TNUiMOYOg .edgePath .path{stroke:#333333;stroke-width:2.0px;}#mermaid-svg-PZ8yiR8TNUiMOYOg .flowchart-link{stroke:#333333;fill:none;}#mermaid-svg-PZ8yiR8TNUiMOYOg .edgeLabel{background-color:#e8e8e8;text-align:center;}#mermaid-svg-PZ8yiR8TNUiMOYOg .edgeLabel rect{opacity:0.5;background-color:#e8e8e8;fill:#e8e8e8;}#mermaid-svg-PZ8yiR8TNUiMOYOg .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#mermaid-svg-PZ8yiR8TNUiMOYOg .cluster text{fill:#333;}#mermaid-svg-PZ8yiR8TNUiMOYOg .cluster span{color:#333;}#mermaid-svg-PZ8yiR8TNUiMOYOg div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#mermaid-svg-PZ8yiR8TNUiMOYOg :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

可信请求

不可信请求

客户端请求

Nginx验证

添加/修改代理头部

丢弃或使用默认值

转发到后端

高级配置：多级代理情况

在多级代理架构中，需要确保每级代理都正确处理转发头部：

# 第一级代理
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

# 第二级代理
proxy_set_header X-Forwarded-For $http_x_forwarded_for, $remote_addr;

结论

正确配置Nginx传递客户端信息对于维护Web应用的功能性和安全性至关重要。通过合理设置各种X-Forwarded-*头部，后端服务器可以获得原始请求的完整上下文，从而做出正确的处理决策。同时，开发者也应注意相关的安全风险，确保不会因过度信任代理头部而引入安全漏洞。

希望本文能帮助您更好地理解和配置Nginx反向代理中的客户端信息传递。根据您的具体应用场景，可以选择性地实现上述配置方案。