Docker 中的端口转发 Rails 应用程序似乎导致 CSRF 异常答案

【问题标题】：Port-forwarded Rails app in Docker seems to cause CSRF exceptionDocker 中的端口转发 Rails 应用程序似乎导致 CSRF 异常
【发布时间】：2015-01-15 04:08:40
【问题描述】：

我有一个在 Docker 容器中运行的 Rails 应用程序，该容器分配了一个 ip 172.17.0.3。对主机 51.x.x.x 的传入请求被转发到 172.17.0.3 中的 rails 应用程序。更具体地说，这样做是这样的：

docker run -p 8080:8080 rails_app

但是，当用户尝试访问某些页面时，Rails 应用程序会抛出 Can't verify CSRF token authenticity 错误。我怀疑 Rails 认为传入的请求是一种攻击，因为目标的 ip 与 Rails 应用程序的 ip 不匹配 - 即用户请求被定向到主机 51.x.x.x，而 Rails 实际位置在 @ 987654328@

我有什么方法可以告诉 Rails 这些请求是合法的吗？作为附加信息，我使用devise 进行身份验证，并使用unicorn 作为服务器。

你们中的一些人可能会建议将protect_from_forgery with: :exception 更改为:null_session，但是当不放置在代理后面时，应用程序可以正常工作。此外，当我更改该部分时，某些逻辑将不起作用，因为我认为该设置与处理用户会话的方式相混淆。

这是我的网络布局：

(user from public network) ----> (proxy) ----> (rails app on a private network)
        (202.x.x.x)            (51.x.x.x)               (172.x.x.x)

编辑：该应用程序位于development 设置中。这是我在log/development.log 文件中遇到的错误。

Started POST "/register" for 202.x.x.x at 2014-11-18 02:27:11 +0000
Processing by UsersController#create as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"aBG3nIAKK1ALMJ1DDYFlMkmqISMBMZc3iLmaeD2byG8=", "user"=>{"email"=>"email@gmail.com", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]"}}
Can't verify CSRF token authenticity
Completed 422 Unprocessable Entity in 2ms

ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):
  actionpack (4.1.4) lib/action_controller/metal/request_forgery_protection.rb:176:in `handle_unverified_request'
  actionpack (4.1.4) lib/action_controller/metal/request_forgery_protection.rb:202:in `handle_unverified_request'
  devise (3.4.0) lib/devise/controllers/helpers.rb:251:in `handle_unverified_request'
  actionpack (4.1.4) lib/action_controller/metal/request_forgery_protection.rb:197:in `verify_authenticity_token'
  activesupport (4.1.4) lib/active_support/callbacks.rb:424:in `block in make_lambda'
  activesupport (4.1.4) lib/active_support/callbacks.rb:160:in `call'
  activesupport (4.1.4) lib/active_support/callbacks.rb:160:in `block in halting'
  activesupport (4.1.4) lib/active_support/callbacks.rb:166:in `call'
  activesupport (4.1.4) lib/active_support/callbacks.rb:166:in `block in halting'
  activesupport (4.1.4) lib/active_support/callbacks.rb:149:in `call'
  activesupport (4.1.4) lib/active_support/callbacks.rb:149:in `block in halting_and_conditional'
  activesupport (4.1.4) lib/active_support/callbacks.rb:149:in `call'
  activesupport (4.1.4) lib/active_support/callbacks.rb:149:in `block in halting_and_conditional'
activesupport (4.1.4) lib/active_support/callbacks.rb:86:in `run_callbacks'
  actionpack (4.1.4) lib/abstract_controller/callbacks.rb:19:in `process_action'
  actionpack (4.1.4) lib/action_controller/metal/rescue.rb:29:in `process_action'
  actionpack (4.1.4) lib/action_controller/metal/instrumentation.rb:31:in `block in process_action'
  activesupport (4.1.4) lib/active_support/notifications.rb:159:in `block in instrument'
  activesupport (4.1.4) lib/active_support/notifications/instrumenter.rb:20:in `instrument'
  activesupport (4.1.4) lib/active_support/notifications.rb:159:in `instrument'
  actionpack (4.1.4) lib/action_controller/metal/instrumentation.rb:30:in `process_action'
  actionpack (4.1.4) lib/action_controller/metal/params_wrapper.rb:250:in `process_action'
  activerecord (4.1.4) lib/active_record/railties/controller_runtime.rb:18:in `process_action'
  actionpack (4.1.4) lib/abstract_controller/base.rb:136:in `process'
  actionview (4.1.4) lib/action_view/rendering.rb:30:in `process'
  actionpack (4.1.4) lib/action_controller/metal.rb:196:in `dispatch'
  actionpack (4.1.4) lib/action_controller/metal/rack_delegation.rb:13:in `dispatch'
  actionpack (4.1.4) lib/action_controller/metal.rb:232:in `block in action'
  actionpack (4.1.4) lib/action_dispatch/routing/route_set.rb:82:in `call'
  actionpack (4.1.4) lib/action_dispatch/routing/route_set.rb:82:in `dispatch'
  actionpack (4.1.4) lib/action_dispatch/routing/route_set.rb:50:in `call'
  actionpack (4.1.4) lib/action_dispatch/routing/mapper.rb:45:in `call'
  actionpack (4.1.4) lib/action_dispatch/journey/router.rb:71:in `block in call'
  actionpack (4.1.4) lib/action_dispatch/journey/router.rb:59:in `each'
  actionpack (4.1.4) lib/action_dispatch/journey/router.rb:59:in `call'
  actionpack (4.1.4) lib/action_dispatch/routing/route_set.rb:678:in `call'
  omniauth (1.2.2) lib/omniauth/strategy.rb:186:in `call!'
  omniauth (1.2.2) lib/omniauth/strategy.rb:164:in `call'
  omniauth (1.2.2) lib/omniauth/strategy.rb:186:in `call!'
  omniauth (1.2.2) lib/omniauth/strategy.rb:164:in `call'
  omniauth (1.2.2) lib/omniauth/strategy.rb:186:in `call!'
  omniauth (1.2.2) lib/omniauth/strategy.rb:164:in `call'
  omniauth (1.2.2) lib/omniauth/strategy.rb:186:in `call!'
  omniauth (1.2.2) lib/omniauth/strategy.rb:164:in `call'
  omniauth (1.2.2) lib/omniauth/strategy.rb:186:in `call!'
  omniauth (1.2.2) lib/omniauth/strategy.rb:164:in `call'
  warden (1.2.3) lib/warden/manager.rb:35:in `block in call'
  warden (1.2.3) lib/warden/manager.rb:34:in `catch'
  warden (1.2.3) lib/warden/manager.rb:34:in `call'
  rack (1.5.2) lib/rack/etag.rb:23:in `call'
  rack (1.5.2) lib/rack/conditionalget.rb:35:in `call'
  rack (1.5.2) lib/rack/head.rb:11:in `call'
  actionpack (4.1.4) lib/action_dispatch/middleware/params_parser.rb:27:in `call'
  actionpack (4.1.4) lib/action_dispatch/middleware/flash.rb:254:in `call'
  rack (1.5.2) lib/rack/session/abstract/id.rb:225:in `context'
  rack (1.5.2) lib/rack/session/abstract/id.rb:220:in `call'
  actionpack (4.1.4) lib/action_dispatch/middleware/cookies.rb:560:in `call'
  activerecord (4.1.4) lib/active_record/query_cache.rb:36:in `call'
  activerecord (4.1.4) lib/active_record/connection_adapters/abstract/connection_pool.rb:621:in `call'
  activerecord (4.1.4) lib/active_record/migration.rb:380:in `call'
  actionpack (4.1.4) lib/action_dispatch/middleware/callbacks.rb:29:in `block in call'
  activesupport (4.1.4) lib/active_support/callbacks.rb:82:in `run_callbacks'
  actionpack (4.1.4) lib/action_dispatch/middleware/callbacks.rb:27:in `call'
  actionpack (4.1.4) lib/action_dispatch/middleware/reloader.rb:73:in `call'
  actionpack (4.1.4) lib/action_dispatch/middleware/remote_ip.rb:76:in `call'
  actionpack (4.1.4) lib/action_dispatch/middleware/debug_exceptions.rb:17:in `call'
  actionpack (4.1.4) lib/action_dispatch/middleware/show_exceptions.rb:30:in `call'
  railties (4.1.4) lib/rails/rack/logger.rb:38:in `call_app'
  railties (4.1.4) lib/rails/rack/logger.rb:20:in `block in call'
  activesupport (4.1.4) lib/active_support/tagged_logging.rb:68:in `block in tagged'
  activesupport (4.1.4) lib/active_support/tagged_logging.rb:26:in `tagged'
  activesupport (4.1.4) lib/active_support/tagged_logging.rb:68:in `tagged'
  railties (4.1.4) lib/rails/rack/logger.rb:20:in `call'
  actionpack (4.1.4) lib/action_dispatch/middleware/request_id.rb:21:in `call'
  rack (1.5.2) lib/rack/methodoverride.rb:21:in `call'
  rack (1.5.2) lib/rack/runtime.rb:17:in `call'
  activesupport (4.1.4) lib/active_support/cache/strategy/local_cache_middleware.rb:26:in `call'
  rack (1.5.2) lib/rack/lock.rb:17:in `call'
  actionpack (4.1.4) lib/action_dispatch/middleware/static.rb:64:in `call'
  rack-cors (0.2.9) lib/rack/cors.rb:54:in `call'
  rack (1.5.2) lib/rack/sendfile.rb:112:in `call'
  railties (4.1.4) lib/rails/engine.rb:514:in `call'
  railties (4.1.4) lib/rails/application.rb:144:in `call'
  rack (1.5.2) lib/rack/lint.rb:49:in `_call'
  rack (1.5.2) lib/rack/lint.rb:37:in `call'
  rack (1.5.2) lib/rack/showexceptions.rb:24:in `call'
  rack (1.5.2) lib/rack/commonlogger.rb:33:in `call'
  sinatra (1.4.5) lib/sinatra/base.rb:217:in `call'
  rack (1.5.2) lib/rack/chunked.rb:43:in `call'
  rack (1.5.2) lib/rack/content_length.rb:14:in `call'
  unicorn (4.8.3) lib/unicorn/http_server.rb:576:in `process_client'
  unicorn (4.8.3) lib/unicorn/http_server.rb:670:in `worker_loop'
  unicorn (4.8.3) lib/unicorn/http_server.rb:525:in `spawn_missing_workers'
  unicorn (4.8.3) lib/unicorn/http_server.rb:140:in `start'
  unicorn (4.8.3) bin/unicorn:126:in `<top (required)>'

【问题讨论】：

你有没有想过这个问题？我刚刚使用 docker 容器在 ubuntu VM 上构建了一个生产环境……flask、mysql、nginx 和 uwsgi。我还在表单上收到 CRSF 令牌错误。
我自己想出了类似的东西...如果您在配置中定义了 SERVER_NAME，请尝试将其删除。
@Chockomonkey 你能详细说明你的意思吗？您的意思是如果您将SERVER_NAME 定义为环境变量？
@ChrisPeters 这是我的应用程序配置中的 SERVER_NAME 变量。我不确定 Rails 是否有类似的东西，但这是我的问题和答案：stackoverflow.com/questions/30134427/…
@Chockomonkey Rails 中没有原生的SERVER_NAME 设置，但感谢您的帮助。

标签： ruby-on-rails devise docker csrf unicorn

【解决方案1】：

通过粗略阅读“protect_from_forgery method”，我们发现以下内容：

  def protect_from_forgery(options = {})
    self.forgery_protection_strategy = protection_method_class(options[:with] || :null_session)
    self.request_forgery_protection_token ||= :authenticity_token
    prepend_before_action :verify_authenticity_token, options
    append_after_action :verify_same_origin_request
  end

它有一个名为“verify_authenticity_token”的操作前回调。如果我们查看它的来源，我们会发现以下内容：

  def verify_authenticity_token
    mark_for_same_origin_verification!

    if !verified_request?
      logger.warn "Can't verify CSRF token authenticity" if logger
      handle_unverified_request
    end
  end

从那里我们注意到它调用了“verified_request?”。

  def verified_request?
    !protect_against_forgery? || request.get? || request.head? ||
      form_authenticity_token == params[request_forgery_protection_token] ||
      form_authenticity_token == request.headers['X-CSRF-Token']
  end

鉴于所引发异常的性质，我认为其中一个或多个条件没有得到满足。我认为这与 IP 地址无关。

【讨论】：

【解决方案2】：

如果您的 Rails 应用程序通过非 SSL 与您的代理通信，则可能会出现 ActiveRecord::SessionStore 因这种情况而无法正常运行的问题。

~~我们的解决方法是使会话存储不安全：~~

OurApplication::Application.config.session_store :active_record_store, secure: false

编辑：仍然没有修复...我们可能不得不让 SSL 在应用程序上终止，而不是通过代理来终止。

所以对我们来说，这个问题最终与 SSL 无关。我们在第一个页面加载时执行了一个 javascript 调用，它试图对后端服务执行握手（通过 POST），但是我们没有正确配置我们的 HAProxy 以将调用路由到该服务，因此 POST 是击中 Rails。尽管 Rails 为路由返回了 404，但由于请求中缺少 CSRF 令牌，它也会重置会话。修复 HAProxy 的路由解决了这个问题。

我们的场景可能与您的场景几乎没有关系，在 Rails 4 中，他们将 protect_from_forgery 的默认行为设置为引发异常而不是重置会话。哦，我们最终还需要将会话存储设置为不安全：

OurApplication::Application.config.session_store :active_record_store, secure: false

【讨论】：