使用 OpenResty + 签名 Cookie 实现"登录一次，1 小时免重复认证"的反代安全网关

worker_processes 1;
events {
    worker_connections 1024;
}
http {
    include mime.types;
    default_type application/octet-stream;
    sendfile on;
    keepalive_timeout 65;
    
    resolver 127.0.0.11 ipv6=off valid=30s;
    
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }
    
    server {
        listen 80;
        server_name _;
        
        # 1) 登录入口：只在这里做 BasicAuth
        location = /__login {
            auth_basic "Restricted";
            auth_basic_user_file /etc/openresty/.htpasswd;
            
            content_by_lua_block {
                local secret = os.getenv("COOKIE_SECRET") or "change_me"
                local cookie_name = os.getenv("COOKIE_NAME") or "ql_auth"
                local ttl = tonumber(os.getenv("COOKIE_TTL") or "3600") or 3600
                
                local function to_hex(s)
                    return (s:gsub(".", function(c) return string.format("%02x", string.byte(c)) end))
                end
                
                local function sign(payload)
                    return to_hex(ngx.hmac_sha1(secret, payload))
                end
                
                local exp = ngx.time() + ttl
                local payload = tostring(exp)
                local token = payload .. "." .. sign(payload)
                
                local secure = ""
                if ngx.var.scheme == "https" then
                    secure = "; Secure"
                end
                
                ngx.header["Set-Cookie"] = cookie_name .. "=" .. token .. "; Path=/; Max-Age=" .. ttl .. "; HttpOnly; SameSite=Lax" .. secure
                
                local next_url = ngx.var.arg_next
                if not next_url or next_url == "" then
                    next_url = "/"
                end
                return ngx.redirect(next_url, 302)
            }
        }
        
        # 2) 退出入口
        location = /__logout {
            content_by_lua_block {
                local cookie_name = os.getenv("COOKIE_NAME") or "ql_auth"
                ngx.header["Set-Cookie"] = cookie_name .. "=deleted; Path=/; Max-Age=0; HttpOnly; SameSite=Lax"
                return ngx.redirect("/", 302)
            }
        }
        
        # 3) 主入口：校验 Cookie
        location / {
            access_by_lua_block {
                local secret = os.getenv("COOKIE_SECRET") or "change_me"
                local cookie_name = os.getenv("COOKIE_NAME") or "ql_auth"
                
                local function to_hex(s)
                    return (s:gsub(".", function(c) return string.format("%02x", string.byte(c)) end))
                end
                
                local function sign(payload)
                    return to_hex(ngx.hmac_sha1(secret, payload))
                end
                
                if ngx.var.uri == "/__login" or ngx.var.uri == "/__logout" then
                    return
                end
                
                local token = ngx.var["cookie_" .. cookie_name]
                local ok = false
                
                if token and token ~= "" then
                    local dot = token:find("%.")
                    if dot then
                        local payload = token:sub(1, dot - 1)
                        local sig = token:sub(dot + 1)
                        
                        if sig == sign(payload) then
                            local exp = tonumber(payload)
                            if exp and exp > ngx.time() then
                                ok = true
                            end
                        end
                    end
                end
                
                if not ok then
                    local next_url = ngx.escape_uri(ngx.var.request_uri)
                    return ngx.redirect("/__login?next=" .. next_url, 302)
                end
            }
            
            proxy_pass http://app:内部端口;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
        }
    }
}