ory kratos csrf cookie 未在 nginx ssl 后面发送

Question

我在docker中使用Go和ory kratos，在localhost上的我的机器上一切正常。身份验证工作，所有cookie都已发送和设置，我可以从SPA调用我的后端并进行身份验证。

问题是，在后面的实时服务器上，显然没有从我的js客户端发送一个cookie（仅发送而不是cookie），并且它在功能中失败，cookie丢失错误。nginxsslory_kratos_sessionxxx_csrf_token

它使用官方的go sdk：kratos-client-go

Go 身份验证必需的中间件

func ExtractKratosCookiesFromRequest(r *http.Request) (csrf, session *http.Cookie, cookieHeader string) {

    cookieHeader = r.Header.Get("Cookie")

    cookies := r.Cookies()

    for _, c := range cookies {

        if c != nil {

            if ok := strings.HasSuffix(c.Name, string("csrf_token")); ok {

                csrf = c

            }

        }

    }

    sessionCookie, _ := r.Cookie("ory_kratos_session")

    if sessionCookie != nil {

        session = sessionCookie

    }

    return

}

func AuthRequired(w http.ResponseWriter, r *http.Request) error {

    csrfCookie, sessionCookie, cookieHeader := ExtractKratosCookiesFromRequest(r)

    if (csrfCookie == nil || sessionCookie == nil) || (csrfCookie.Value == "" || sessionCookie.Value == "") {

        return errors.New("Cookie missing")

    }

    req := kratos.PublicApi.Whoami(r.Context()).Cookie(cookieHeader)

    kratosSession, _, err := req.Execute()

    if err != nil {

        return errors.New("Whoami error")

    }

    

    return nil

}

我的 js http 客户端有选项：.credentials: 'include'

在devtools面板中，我只看到1个cookie（）在注册/登录后。ory_kratos_session

因此，失败的是请求仅发送而不是cookie（在kratos模式下工作，并且cookie在devtools面板中是可行的）ory_kratos_sessionxxx_csrf_tokenlocalhost--dev

Answer 1

我相信你的kratos配置不正确。该属性应该是请求源自的 url，例如 而不是您的本地主机。serve.public.base_urlhttps://example.com/kratos/http://127.0.0.1:4433另外，只是一个建议，您的管理端点永远不应该向公众公开，您的后端服务应该在内部网络上请求管理员URL（例如，在Docker内部或localhost上）。你应该从nginx中删除。serve.admin.base_urlhttp://127.0.0.1:4434nginx配置对我来说似乎是正确的。我相信你只需要这个就可以了：location /kratos/ {     proxy_set_header Host $host;     proxy_set_header Upgrade $http_upgrade;     proxy_set_header Connection "upgrade";     proxy_pass http://127.0.0.1:4433;     }

Answer 2

我确实设法解决了这个问题，它在生产中没有标志的情况下工作正常，即使在重新启动服务和更改所有内容后也不会搞砸。--dev也许它甚至是我的反应形式，我使用defaultValue作为csrf令牌输入现在，每当 window.location url 更改或csrf_token更改时，它都应该使用最新的值作为csrf_tokenconst [csrf, setCsrf] = React.useState('');useEffect(() => {&nbsp; if (flowResponse !== null) {&nbsp; &nbsp; const csrfVal = flowResponse?.ui?.nodes?.find?.(n => n.attributes.name === 'csrf_token')?.attributes.value;&nbsp; &nbsp; setCsrf(csrfVal);&nbsp; }}, [flowResponse, csrf]);<input type='hidden' name='csrf_token' value={csrf} readOnly required />最糟糕的是，它也可能是一个尾部斜杠或如此小的东西，我不确定究竟是什么原因造成的。在这里，所有人都发布了所有适合我的配置：可能是我以前尝试过这个kratos网址 http://127.0.0.1:4433 或 http://kratos:4433，但它不起作用（即使我在这3个之间切换哈哈）init kratos clientconf := kratos.NewConfiguration()conf.Servers[0].URL = "https://example.com/kratos/"kratosClient := kratos.NewAPIClient(conf)kratos.ymlversion: v0.6.2-alpha.1dsn: postgres://test:test@postgresd:5432/test?sslmode=disable&max_conns=20&max_idle_conns=4serve:&nbsp; public:&nbsp; &nbsp; base_url: https://example.com/kratos/&nbsp; &nbsp; cors:&nbsp; &nbsp; &nbsp; enabled: true&nbsp; &nbsp; &nbsp; debug: true&nbsp; &nbsp; &nbsp; allow_credentials: true&nbsp; &nbsp; &nbsp; options_passthrough: true&nbsp; &nbsp; &nbsp; max_age: 0&nbsp; &nbsp; &nbsp; allowed_origins:&nbsp; &nbsp; &nbsp; &nbsp; - https://example.com&nbsp; &nbsp; &nbsp; allowed_methods:&nbsp; &nbsp; &nbsp; &nbsp; - POST&nbsp; &nbsp; &nbsp; &nbsp; - GET&nbsp; &nbsp; &nbsp; &nbsp; - PUT&nbsp; &nbsp; &nbsp; &nbsp; - PATCH&nbsp; &nbsp; &nbsp; &nbsp; - DELETE&nbsp; &nbsp; &nbsp; &nbsp; - OPTIONS&nbsp; &nbsp; &nbsp; allowed_headers:&nbsp; &nbsp; &nbsp; &nbsp; - Authorization&nbsp; &nbsp; &nbsp; &nbsp; - Cookie&nbsp; &nbsp; &nbsp; &nbsp; - Origin&nbsp; &nbsp; &nbsp; &nbsp; - X-Session-Token&nbsp; &nbsp; &nbsp; exposed_headers:&nbsp; &nbsp; &nbsp; &nbsp; - Content-Type&nbsp; &nbsp; &nbsp; &nbsp; - Set-Cookie&nbsp; admin:&nbsp; &nbsp; base_url: http://127.0.0.1:4434/selfservice:&nbsp; default_browser_return_url: https://example.com&nbsp; whitelisted_return_urls:&nbsp; &nbsp; - https://example.com&nbsp; &nbsp; - https://example.com/dashboard&nbsp; &nbsp; - https://example.com/auth/login&nbsp; methods:&nbsp; &nbsp; password:&nbsp; &nbsp; &nbsp; enabled: true&nbsp; &nbsp; oidc:&nbsp; &nbsp; &nbsp; enabled: false&nbsp; &nbsp; link:&nbsp; &nbsp; &nbsp; enabled: true&nbsp; &nbsp; profile:&nbsp; &nbsp; &nbsp; enabled: true&nbsp; flows:&nbsp; &nbsp; error:&nbsp; &nbsp; &nbsp; ui_url: https://example.com/error&nbsp; &nbsp; settings:&nbsp; &nbsp; &nbsp; ui_url: https://example.com/dashboard/profile&nbsp; &nbsp; &nbsp; privileged_session_max_age: 15m&nbsp; &nbsp; recovery:&nbsp; &nbsp; &nbsp; enabled: true&nbsp; &nbsp; &nbsp; ui_url: https://example.com/auth/recovery&nbsp; &nbsp; &nbsp; after:&nbsp; &nbsp; &nbsp; &nbsp; default_browser_return_url: https://example.com/auth/login&nbsp; &nbsp; verification:&nbsp; &nbsp; &nbsp; enabled: true&nbsp; &nbsp; &nbsp; ui_url: https://example.com/auth/verification&nbsp; &nbsp; &nbsp; after:&nbsp; &nbsp; &nbsp; &nbsp; default_browser_return_url: https://example.com&nbsp; &nbsp; logout:&nbsp; &nbsp; &nbsp; after:&nbsp; &nbsp; &nbsp; &nbsp; default_browser_return_url: https://example.com&nbsp; &nbsp; login:&nbsp; &nbsp; &nbsp; ui_url: https://example.com/auth/login&nbsp; &nbsp; &nbsp; lifespan: 10m&nbsp; &nbsp; registration:&nbsp; &nbsp; &nbsp; lifespan: 10m&nbsp; &nbsp; &nbsp; ui_url: https://example.com/auth/registration&nbsp; &nbsp; &nbsp; after:&nbsp; &nbsp; &nbsp; &nbsp; password:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hooks:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - hook: session&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; default_browser_return_url: https://example.com/auth/login&nbsp; &nbsp; &nbsp; &nbsp; default_browser_return_url: https://example.com/auth/login&nbsp; &nbsp; &nbsp; &nbsp; oidc:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hooks:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - hook: sessionsecrets:&nbsp; cookie:&nbsp; &nbsp; - veRy_S3cRet_tHinGsession:&nbsp; lifespan: 24h&nbsp; cookie:&nbsp; &nbsp; domain: example.com&nbsp; &nbsp; same_site: Lax&nbsp; &nbsp; path: /&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// <- i didn't have path before, not sure if it changes anything but it works (before csrf cookie had path /kratos and now when it works it has path /, same as session_cookie)hashers:&nbsp; argon2:&nbsp; &nbsp; parallelism: 1&nbsp; &nbsp; memory: 128MB&nbsp; &nbsp; iterations: 1&nbsp; &nbsp; salt_length: 16&nbsp; &nbsp; key_length: 16identity:&nbsp; default_schema_url: file:///etc/config/kratos/identity.schema.jsoncourier:&nbsp; smtp:&nbsp; &nbsp; connection_uri: smtp://user:[e-mail]:2525&nbsp; &nbsp; from_name: example&nbsp; &nbsp; from_address: [e-mail]-courier: truelog:&nbsp; level: debug&nbsp; format: text&nbsp; leak_sensitive_values: truenginx.confserver {&nbsp; &nbsp; server_name example.com www.example.com;&nbsp; &nbsp; location / {&nbsp; &nbsp; &nbsp; &nbsp;root /var/www/public;&nbsp; &nbsp; &nbsp; &nbsp;try_files $uri $uri/ /index.html;&nbsp; &nbsp; }&nbsp; &nbsp; location /api/ {&nbsp; &nbsp; &nbsp; proxy_pass http://127.0.0.1:3001; // backend api url&nbsp; &nbsp; &nbsp; proxy_http_version 1.1;&nbsp; &nbsp; &nbsp; proxy_set_header Host $host;&nbsp; &nbsp; &nbsp; proxy_set_header X-Real-IP $remote_addr;&nbsp; &nbsp; &nbsp; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;&nbsp; &nbsp; &nbsp; proxy_set_header X-Forwarded-Port $server_port;&nbsp; &nbsp; &nbsp; proxy_set_header x-forwarded-proto $scheme;&nbsp; &nbsp; &nbsp; proxy_set_header Upgrade $http_upgrade;&nbsp; &nbsp; &nbsp; proxy_set_header Connection 'upgrade';&nbsp; &nbsp; &nbsp; proxy_cache_bypass $http_upgrade;&nbsp; &nbsp; }&nbsp; &nbsp; location /kratos/ {&nbsp; &nbsp; &nbsp; proxy_pass http://127.0.0.1:4433/;&nbsp; // kratos public url&nbsp; &nbsp; &nbsp; proxy_http_version 1.1;&nbsp; &nbsp; &nbsp; proxy_set_header Host $host;&nbsp; &nbsp; &nbsp; proxy_set_header X-Real-IP $remote_addr;&nbsp; &nbsp; &nbsp; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;&nbsp; &nbsp; &nbsp; proxy_set_header X-Forwarded-Port $server_port;&nbsp; &nbsp; &nbsp; proxy_set_header x-forwarded-proto $scheme;&nbsp; &nbsp; &nbsp; proxy_set_header Upgrade $http_upgrade;&nbsp; &nbsp; &nbsp; proxy_set_header Connection 'upgrade';&nbsp; &nbsp; &nbsp; proxy_cache_bypass $http_upgrade;&nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; &nbsp; listen [::]:443 ssl ipv6only=on; # managed by Certbot&nbsp; &nbsp; listen 443 ssl; # managed by Certbot&nbsp; &nbsp; certs...}server {&nbsp; &nbsp; if ($host = www.example.com) {&nbsp; &nbsp; &nbsp; &nbsp; return 301 https://$host$request_uri;&nbsp; &nbsp; } # managed by Certbot&nbsp; &nbsp; if ($host = example.com) {&nbsp; &nbsp; &nbsp; &nbsp; return 301 https://$host$request_uri;&nbsp; &nbsp; } # managed by Certbot&nbsp; &nbsp;listen 80 default_server;&nbsp; &nbsp;listen [::]:80 default_server;&nbsp; &nbsp;server_name example.com www.example.com;&nbsp; &nbsp;return 404; # managed by Certbot}