June 2021
Intermediate to advanced
290 pages
9h 21m
Chinese
Content preview from Node与Express开发（第2版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
200
｜
第
18
章
18.1.6
HTTPS
与代理
我们已经看到了，在
Express
中使用
HTTPS
非常容易，而且对于开发环境来说，运行也
很正常。可是，等到你想要扩展网站以便应付更大的流量的时候，就会希望使用一个像
NGINX
这样的代理服务器
（参见第
12
章）。如果网站是在共享托管环境中运行，那么几
乎可以肯定的是，会存在一个代理服务器，把请求路由到你的应用。
如果你在使用一个代理服务器，那么客户端（用户的浏览器）会跟这个
代理服务器
而不是
服务器通信。而这个代理服务器跟应用的通信很有可能是基于常规
HTTP
（因为应用和代
理服务器会共同运行于一个受信任的网络）。你会常常听到人们说“
HTTPS
终结
于代理服
务器”，或者“代理服务器做的就是终结
SSL
的工作”
。
大多数情况下，不管是你还是托管服务提供商，一旦正确地配置了处理
HTTPS
请求的代
理服务器，就不需要做任何额外的工作了，除非你的应用需要同时处理安全和不安全的请
求，不过这是特例。
对于需要同时处理安全和不安全的请求这个问题，有两个解决方案。第一个方案是直接配
置代理服务器，让它把所有的
HTTP
流量都重定向到
HTTPS
，从根本上强制所有跟应用的
通信都基于
HTTPS
。现在这种方法比以前普及多了，也的确是一个比较容易的解决方案。
第二个方案是把用于客户端跟代理之间通信的协议传送到应用服务器。通常的传送方式是
通过
X-Forwarded-Proto
请求头。例如，在
NGINX
中设置以下请求头：
proxy_set_header X-Forwarded-Proto $scheme; ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.