Ta yaya ake amincewa da IP na client da iyakance buƙatu bayan CDN?

Question

IT Interview Practice · Accepted Answer

Maido da adireshin client daga proxy da aka amince da shi kafin iyakance buƙatu bisa IP. In ba haka ba, za a iya ƙirga baƙi da yawa a matsayin server na CDN ɗaya.

## Dalilin da ya sa ake toshe mutanen da ba su dace ba

Alice da Bob duk suna bi ta adireshin CDN ɗaya. Ba tare da real-IP handling ba, Nginx yana ganin wannan adireshin ga su biyu. Zirga-zirgar Alice na iya cinye quota da ake ganin Bob yana rabawa.

## Amince da proxy, ba kowane header mai shigowa ba

Wannan configuration na misali yana shiga cikin `http`. Dole a maye gurbin adireshin takardu da ainihin ranges na proxies da aka amince da su; misalin yana ɗauka cewa proxy yana kula da `X-Forwarded-For` daidai:

```nginx
set_real_ip_from 192.0.2.10;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
limit_req_zone $binary_remote_addr zone=per_client:10m rate=5r/s;

server {
    listen 80;
    location /api/ {
        limit_req zone=per_client burst=10;
        limit_req_status 429;
        proxy_pass http://127.0.0.1:3000;
    }
}
```

`set_real_ip_from` yana tantance wanda zai iya bayar da adireshin. Recursive processing yana zaɓar adireshin ƙarshe da ba a amince da shi ba a cikin forwarded chain. `limit_req_zone` sai ya ƙirga da IP na client da aka maido; `limit_req` yana amfani da iyakar a route. Anan ana iya jinkirta ƙarin buƙatu cikin burst, yayin da waɗanda suka wuce ana ƙin su. Rates ɗin misalai ne, ba production defaults ba.

## Tabbatar kafin tilastawa

Yi amfani da `limit_req_dry_run on;` lokacin tantancewa. Duba adireshin client biyu da ƙoƙarin ƙirƙirar headers na ƙarya daga tushe marar amana. Takaita shiga origin kai tsaye kuma ka kula da trusted ranges. IP na ofis da aka raba har yanzu yana haɗa mutane na gaske, don haka ƙara iyaka ta asusun da aka tantance inda ya dace.

[Takardun hukuma](https://nginx.org/en/docs/http/ngx_http_realip_module.html).

Dalilin da ya sa ake toshe mutanen da ba su dace ba

Amince da proxy, ba kowane header mai shigowa ba

Tabbatar kafin tilastawa

Tambayoyi masu alaƙa