ACL configuration based on device and browser fingerprint in Nginx reverse proxy

With the popularity of mobile Internet and multi-terminal devices, the access methods and device types of websites are becoming more and more abundant. In order to ensure the stability and security of the website, the website server needs to perform a reverse proxy and also needs to restrict different devices and browser types. This requires the use of ACL configuration based on device and browser fingerprints in the Nginx reverse proxy.

What is Nginx reverse proxy?

Nginx reverse proxy is a proxy method in which the server acts as a client to access other server resources. To put it simply, a proxy server is added between the client and the server. The client requests resources from the proxy server, and the proxy server requests resources from the real server, and then returns the request results to the client. This method can effectively reduce the pressure on the server and improve the performance and reliability of the website.

ACL configuration in Nginx reverse proxy

ACL (Access Control List, Access Control List) is a function in Nginx reverse proxy that is used to determine the IP address requested by the client. , request method, URL and other conditions to filter and limit. In ACL, we can also restrict based on device type and browser type.

Since different devices and browser types have different rendering methods and specifications, we can make different responses based on these characteristics, such as providing different page structures, styles or resources. At the same time, you can also restrict requests from certain devices or browsers through ACL configuration to improve the security and stability of the website.

ACL configuration based on device and browser fingerprints

There are so many types of devices and browsers now that it is obviously unrealistic to manually configure them one by one. But fortunately, Nginx reverse proxy provides a third-party module deviceatlas, through which we can automatically identify the device and browser type.

Install deviceatlas module

Take CentOS as an example, first install the necessary dependencies:

sudo yum install gcc-c pcre-devel zlib-devel

Then download the deviceatlas module, unzip and install it:

sudo wget -O ~/deviceatlas.tar.gz https://github.com/devicedetection/device-nginx/archive/master.tar.gz
sudo tar zxvf ~/deviceatlas.tar.gz -C ~/
cd ~/device-nginx-master
sudo ./configure --add-module=$PWD
sudo make && sudo make install

After the above steps, we can use the deviceatlas module in Nginx.

Configure Nginx reverse proxy

In the Nginx configuration file, add the following configuration:

http {

deviceatlas /usr/share/devicedata/51Degrees.dat;

map $device_is_mobile $acl {
    ""               block_ua;
    "true"           allow;
    "false"          block_ua;
}

map $device_brand_name $brand_map {
     "~Huawei"       "huawei.com";
     "~Samsung"      "samsung.com";
     "~Apple"        "apple.com";
     default         "default.com"
}

server {
    listen       80;
    server_name  server.com;

    location / {
        if ($acl = "allow") {
            proxy_pass http://backend;
        }
        if ($acl = "block_ua") {
            return 403;
        }
    }

    location /brand {
        proxy_pass http://$brand_map;
    }
}

}

Analysis The above configuration:

First use the deviceatlas module to load the device information file;

Use the map command to classify the device into "mobile" and "non-mobile". Unidentified devices are considered non-mobile. After the device is classified, we can easily make different responses according to different device types;

Use another map command to map the device brand name to the corresponding back-end server domain name;

On the Nginx reverse proxy server, use the location directive to match the request URL. If the current request comes from a mobile device, the proxy request is allowed; if the current request comes from an unknown device or a non-mobile device, the proxy request is not allowed;

When requesting the specified URL, if the request comes from a mobile device and the brand is Huawei, Samsung, or Apple, the request will be proxied to the corresponding server; otherwise, if the request comes from an unknown device or a non-mobile device or the brand does not match any of the items , the request will be proxied to the default server.

Summary

ACL configuration based on device and browser fingerprints can help the Nginx reverse proxy server filter and respond to diverse access devices and diverse access methods. The Nginx reverse proxy server can automatically identify the device brand, model and browser type by using the deviceatlas module, and make corresponding ACL configurations based on specific conditions, thereby improving the performance, security and stability of the website.

The above is the detailed content of ACL configuration based on device and browser fingerprint in Nginx reverse proxy. For more information, please follow other related articles on the PHP Chinese website!