时间戳

首页 > 解决方案 > 502 网关错误，报头大小

node.js - 502 网关错误，报头大小

问题描述

由于我们的组织正在为员工使用 SSO，当用户尝试使用 shibboleth 登录时，我们会收到 502 错误网关。

拥有更多组访问权限并尝试登录的用户会收到 502，但访问权限较少的用户可以登录。

所有访问的最大标头大小为 32768。

我们尝试了--max-http-header-size 42768in docker，但它并没有帮助。具有正常访问权限（较小标头大小）的用户能够登录。

我们的设置：VM1 托管 nginx 作为反向代理。配置如下。VM2 托管多个 docker。

server {
listen 80;
server_name **********;

proxy_buffering off;
proxy_set_header X-Real-IP  $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;

client_body_timeout 60s;
client_header_timeout 60s;
keepalive_timeout 70s;
send_timeout 60s;

client_body_buffer_size 32k;
client_header_buffer_size 32k;
client_max_body_size 0;
large_client_header_buffers 4 32k;

access_log off;
error_log /data/nginx/logs/****_error.log warn;

location / {
    proxy_pass http://******:8098;
}

}

Error log:
2019/09/25 10:25:38 [error] 20070#0: *123 upstream prematurely closed 
connection while reading response header from upstream, client: ****, 
server: ******, request: "GET /auth/shibboleth?redirect=L2FjY291bnQ= 
HTTP/1.1", upstream: "http://******:8098/auth/shibboleth?redirect=L2FjY291bnQ=", 
 host: "*****", referrer: 
"https://******/profile/SAML2/Redirect/SSO?execution=e1s2"
2019/09/25 10:25:50 [error] 20070#0: *125 upstream prematurely closed 
connection while reading response header from upstream, client: ****, 
server: *****, request: "GET / HTTP/1.1", upstream: "http://****:8098/", 
 host: "*****"

  Docker setup

  FROM node:8-alpine as intermediate

  RUN apk add --no-cache git openssh alpine-sdk python2
  RUN python2 -m ensurepip && \
    rm -r /usr/lib/python*/ensurepip && \
    pip install --upgrade pip setuptools && \
    if [[ ! -e /usr/bin/python ]]; then ln -sf /usr/bin/python2 
  /usr/bin/python; fi

  WORKDIR /usr/src/app

  RUN touch config.js && mkdir config
  COPY package*.json ./
  RUN http_proxy="http://****:3128" https_proxy="http://****:3128" npm install

  COPY . .
  RUN rm -rf .private


 FROM node:8-alpine

 WORKDIR /usr/src/app
 COPY --from=intermediate /usr/src/app /usr/src/app

 EXPOSE 8080
 CMD [ "node", "app.js", "-p 8080" ]

标签： node.jsdocker

解决方案

这显然很常见。修复：

proxy_buffer_size          128k;
proxy_buffers              4 256k;
proxy_busy_buffers_size    256k;

参见例如

推荐阅读