一、概述

需求：所有访问/webapi/**的请求必须是POST请求，而且根据请求参数过滤不符合规则的非法请求(黑名单), 这些请求一律不转发到后端服务器(Tomcat)

二、具体实现

1.lua代码

[root@git-server ~]# cat /usr/local/nginx/conf/lua/ipblacklist.luangx.req.read_body()local redis = require "resty.redis"local red = redis.new()red.connect(red, '127.0.0.1', '6379')local myIP = ngx.req.get_headers()["X-Real-IP"]if myIP == nil then   myIP = ngx.req.get_headers()["x_forwarded_for"]endif myIP == nil then   myIP = ngx.var.remote_addrendif ngx.re.match(ngx.var.uri,"^(/webapi/).*$") then    local method = ngx.var.request_method    if method == 'POST' then        local args = ngx.req.get_post_args()        local hasIP = red:sismember('black.ip',myIP)        local hasIMSI = red:sismember('black.imsi',args.imsi)        local hasTEL = red:sismember('black.tel',args.tel)        if hasIP==1 or hasIMSI==1 or hasTEL==1 then            --ngx.say("This is 'Black List' request")            ngx.exit(ngx.HTTP_FORBIDDEN)          end        else            --ngx.say("This is 'POST' request")            ngx.exit(ngx.HTTP_FORBIDDEN)          end         end

2.nginx.conf

location / {root html;index index.html index.htm;access_by_lua_file /usr/local/nginx/conf/lua/ipblacklist.lua;proxy_pass http://127.0.0.1:8080;client_max_body_size 1m;}

3.添加黑名单规则数据

#redis-cli sadd black.ip '153.34.118.50'#redis-cli sadd black.imsi '460123456789' #redis-cli sadd black.tel '15888888888'

可以通过redis-cli smembers black.imsi 查看列表明细

4.验证结果

[root@git-server ~]# curl -d "imsi=460123456789&tel=15800000000" "http://www.kjios.com/myapi/111"
    
     
404 Not Found
    
    
    
     nginx