HAProxy中的JWT验证

Question

我有一个HAProxy配置为接受*.mysubdomain.com的请求.HAProxy将解析子域(prod或dev来自prod.mysubdomain.com或dev.mysubdomain.com)并转发到正确的后端.存在两个后端,一个用于产品,一个用于开发.每个后端包含两个服务器条目,指向每个子域上的Marathon LB实例.

子域需要JWT cookie才能在后端进行身份验证.我有公钥来检查JWT的有效性,但是希望在HAProxy中这样做.有没有办法添加我自己的代码来执行HAProxy配置中的JWT有效性检查？

HAProxy配置文件如下:

global
    maxconn 256

defaults
    mode http
    timeout connect 5000ms
    timeout client 50000ms
    timeout server 50000ms

frontend http-in
    bind *:80
    mode http

    # Returns true when one of the headers contains one of the strings either isolated or delimited by dots. This is used to perform domain name matching.
    acl host_dev hdr_dom(host) -i dev
    acl host_prod hdr_dom(host) -i prod

    acl jwtPresent req.cook(JWT) -m found

    use_backend prod_domain if jwtPresent host_prod
    use_backend dev_domain if jwtPresent host_dev

    default_backend prod_domain

backend prod_domain
    balance roundrobin
    server prodDomain1 "${MARATHON_LB_PROD_1}" maxconn 32 check
    server prodDomain2 "${MARATHON_LB_PROD_2}" maxconn 32 check

backend dev_domain
    balance roundrobin
    server devDomain1 "${MARATHON_LB_DEV_1}" maxconn 32 check
    server devDomain2 "${MARATHON_LB_DEV_2}" maxconn 32 check

Answer 1

HAProxy 可以充当 API 网关并根据公钥验证 JWT 令牌。他们撰写了一篇博文并提供了示例代码来向您展示如何操作。

该帖子在这里：https://www.haproxy.com/blog/using-haproxy-as-an-api-gateway-part-2-authentication/

示例lua代码在这里：https://github.com/haproxytech/haproxy-lua-jwt

Answer 2

据我所知，HAProxy 不具备执行验证 JWT 逻辑的功能。相反，我在 Lua 中实现了一个脚本，供 haproxy.cfg 调用以执行验证：

global
    maxconn 256
    lua-load /choose_backend.lua

defaults
    mode http
    timeout connect 5000ms
    timeout client 50000ms
    timeout server 50000ms

frontend http-in
    bind *:80

    http-request set-header X-SSL-Client-DN             %{+Q}[ssl_c_s_dn]


    http-request set-var(txn.backend_name) lua.backend_select()
    use_backend %[var(txn.backend_name)]

backend prod_domain
    balance roundrobin
    server prodDomain1 "${MARATHON_LB_PROD_1}" maxconn 32 check
    server prodDomain2 "${MARATHON_LB_PROD_2}" maxconn 32 check

backend dev_domain
    balance roundrobin
    server devDomain1 "${MARATHON_LB_DEV_1}" maxconn 32 check
    server devDomain2 "${MARATHON_LB_DEV_2}" maxconn 32 check