Nginx配置静态WEB服务

1.静态参数配置
1)文件读取高效sendfile

Syntax: sendfile on | off;
Default: sendfile off;
Context: http, server, location, if in location

2)提高网络传输效率nopush

Syntax: tcp_nopush on | off;
Default: tcp_nopush off;
Context: http, server, location

3)提高网络传输实时性tcp_nodelay

Syntax: tcp_nodelay on | off;
Default: tcp_nodelay on;
Context: http, server, location

2.静态资源文件压缩
Nginx将响应报文发送至客户端之前可以启用压缩功能,这能够有效地节约带宽,并提高响应至客户端的速度。

1)gzip压缩配置语法

Syntax: gzip on | off;
Default: gzip off;
Context: http, server, location, if in location

2)gzip压缩比率配置语法

Syntax: gzip_comp_level level;
Default: gzip_comp_level 1;
Context: http, server, location

3)gzip压缩协议版本

Syntax: gzip_http_version 1.0 | 1.1;
Default: gzip_http_version 1.1;
Context: http, server, location

4)扩展压缩模块

Syntax: gzip_static on | off | always;
Default: gzip_static off;
Context: http, server, location

5)图片压缩案例

[root@localhost conf.d]# mkdir -p /usr/share/nginx/html/images
[root@localhost conf.d]# vim server.conf 
server {
listen 80;
server_name 127.0.0.1;
sendfile on;
access_log /var/log/nginx/access.log main;

location ~ .*\.(jpg|gif|png)$ {
gzip on;
gzip_http_version 1.1;
gzip_comp_level 2;
gzip_types text/plain application/json application/x-javascript application/css application/xml application/xml+rss text/javascript application/x-httpd-php image/jpeg image/gif image/png;
root /usr/share/nginx/html/images;
}
}

6)文件压缩案例

[root@localhost conf.d]# mkdir -p /usr/share/nginx/html/doc
[root@localhost conf.d]# vim server.conf 
server {
listen 80;
server_name 127.0.0.1;
sendfile on;
access_log /var/log/nginx/access.log main;
location ~ .*\.(txt|xml)$ {
gzip on;
gzip_http_version 1.1;
gzip_comp_level 1;
gzip_types text/plain application/json application/x-javascript application/css application/xml application/xml+rss text/javascript application/x-httpd-php image/jpeg image/gif image/png;
root /usr/share/nginx/html/doc;
}
} 

3.静态资源浏览器缓存
HTTP协议定义的缓存机制(如: Expires; Cache-control 等)

1)缓存配置语法expires

Syntax: expires [modified] time;
expires epoch | max | off;
Default: expires off;
Context: http, server, location, if in location

2)配置静态资源缓存

location ~ .*\.(js|css|html)$ {
root /usr/share/nginx/html/js;
expires 1h;
}

location ~ .*\.(jpg|gif|png)$ {
root /usr/share/nginx/html/images;
expires 7d;
}

3)开发代码没有正式上线时, 希望静态文件不被缓存

#取消js css html等静态文件缓存
location ~ .*\.(css|js|swf|json|mp4|htm|html)$ {
add_header Cache-Control no-store;
add_header Pragma no-cache;
}

4.静态资源跨域访问

Syntax: add_header name value [always];
Default: —
Context: http, server, location, if in location

Access-Control-Allow-Origin

1)配置Nginx跨域访问

[root@localhost conf.d]# vim origin.conf 
server {
listen 80;
server_name www.example.com;
root html;
index index.html index.htm;
location ~ .*\.(html|htm)$ {
add_header 'Access-Control-Allow-Origin' $http_origin;
add_header 'Access-Control-Allow-Credentials' 'true';
add_header 'Access-Control-Allow-Methods' 'GET,POST,PUT,DELETE,OPTIONS';
add_header 'Access-Control-Allow-Headers' 'DNT,Authorization,Accept,Origin,Keep-Alive,User-Agent,X-Mx-ReqToken,X-Data-Type,X-Auth-Token,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
if ($request_method = 'OPTIONS') {
add_header 'Access-Control-Max-Age' 1728000;
add_header 'Content-Type' 'text/plain; charset=utf-8';
add_header 'Content-Length' 0;
return 204;
}
}
}

2)参数解释

1、Access-Control-Allow-Origin,这里使用变量 $http_origin取得当前来源域,“*”代表允许所有;
2、Access-Control-Allow-Credentials,为 true 的时候指请求时可带上Cookie;
3、Access-Control-Allow-Methods,OPTIONS一定要有的,另外一般也就GET和POST,如果你有其它的也可加进去;
4、Access-Control-Allow-Headers,这个要注意,里面一定要包含自定义的http头字段;
5、Access-Control-Expose-Headers,可不设置,大致意思是默认只能获返回头的6个基本字段,要获取其它额外的,先在这设置才能获取它;
6、语句“ if ($request_method = 'OPTIONS') { ”,因为浏览器判断是否允许跨域时会先往后端发一个 options 请求,然后根据返回的结果判断是否允许跨域请求,所以这里单独判断这个请求,然后直接返回;

5.静态资源防盗链
盗链指的是在自己的界面展示不在自己服务器上的内容,通过技术手段获得他人服务器的资源地址,绕过别人资源展示页面,在自己页面向用户提供此内容,从而减轻自己服务器的负担,因为真实的空间和流量来自别人服务器。
防盗链设置思路: 区别哪些请求是非正常用户请求

基于http_refer防盗链配置模块

Syntax: valid_referers none | blocked | server_names | string ...;
Default: —
Context: server, location

1)配置静态资源防盗链

#支持IP、域名、正则方式
location ~ .*\.(jpg|gif|png)$ {
valid_referers none blocked www.example.com;
if ($invalid_referer) {
return 403;
}
root /usr/share/nginx/html/images;
}

location ~ .*\.(jpg|gif|png)$ {
    root html;
    valid_referers none blocked www.example.com;
    if ($invalid_referer){
return 403;        
rewrite ^/ http://127.0.0.1/images/loading.jpg;
    }

}

2)参数解释

1、valid_referers这个关键字定义了白名单;
2、invalid_referer是内置变量,通过判断上一行中的valid_referers值会返回0或者1;
3、none代表请求头中没有referer信息,这一般是直接在浏览器输入图片网址;
4、blocked代表被防火墙过滤标记过的请求;
5、如果访问来源不在白名单内,则返回403错误;
6、可以通过设定指定的图片来代替目标图片;

3)验证
这种实现可以限制大多数普通的非法请求,但不能限制有目的的请求,因为这种方式可以通过伪造referer信息来绕过

#伪造协议头访问
[root@localhost ~]# curl -e "http://www.baidu.com" -I http://127.0.0.1/test.jpg
HTTP/1.1 403 Forbidden
Server: nginx/1.18.0
Date: Thu, 09 Jul 2020 07:41:38 GMT
Content-Type: text/html
Content-Length: 153
Connection: keep-alive

#伪造协议头访问
[root@localhost ~]# curl -e "http://www.example.com" -I http://127.0.0.1/test.jpg
HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: Thu, 09 Jul 2020 07:41:01 GMT
Content-Type: image/jpeg
Content-Length: 5
Last-Modified: Thu, 09 Jul 2020 07:32:36 GMT
Connection: keep-alive
ETag: "5f06c814-5"
Accept-Ranges: bytes
上一篇:nginx优化:配置gzip压缩页面提高访问速度(nginx1.18.0)


下一篇:利用gzip压缩文档能够显著地减少HTML文档的下载时间