[GH-ISSUE #35] 使用v5.1.0版本，网站出现MIME type不匹配问题 #154

New issue

Closed

opened 2026-03-13 16:38:00 +03:00 by kerem · 3 comments

kerem commented

2026-03-13 16:38:00 +03:00

Owner

Originally created by @hibobmaster on GitHub (Apr 23, 2021).
Original GitHub issue: https://github.com/ADD-SP/ngx_waf/issues/35

具体表现为网站的大部分图片和部分样式返回403,F12显示MIME type全是('text/html')
换回v5.0.0版本，一切都正常

nginx -V

nginx version: nginx/1.19.10
built with OpenSSL 1.1.1k  25 Mar 2021
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -fPIC' --with-openssl=/build/nginx/../openssl --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-compat --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_flv_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_secure_link_module --with-http_sub_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-stream=dynamic --with-stream_geoip_module=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module --add-module=/build/nginx/sb-modules/ngx_brotli --add-dynamic-module=/build/nginx/debian/modules/http-headers-more-filter --add-dynamic-module=/build/nginx/debian/modules/http-auth-pam --add-dynamic-module=/build/nginx/debian/modules/http-cache-purge --add-dynamic-module=/build/nginx/debian/modules/http-dav-ext --add-dynamic-module=/build/nginx/debian/modules/http-ndk --add-dynamic-module=/build/nginx/debian/modules/http-echo --add-dynamic-module=/build/nginx/debian/modules/http-fancyindex --add-dynamic-module=/build/nginx/debian/modules/http-geoip2 --add-dynamic-module=/build/nginx/sb-modules/ngx_http_ipdb_module --add-dynamic-module=/build/nginx/debian/modules/nchan --add-dynamic-module=/build/nginx/debian/modules/http-lua --add-dynamic-module=/build/nginx/debian/modules/rtmp --add-dynamic-module=/build/nginx/debian/modules/http-uploadprogress --add-dynamic-module=/build/nginx/debian/modules/http-upstream-fair --add-dynamic-module=/build/nginx/debian/modules/http-subs-filter

使用的配置如下

    waf on;
    waf_rule_path /etc/nginx/ngx_waf/rules/;
    waf_mode DYNAMIC;
    waf_cc_deny  rate=10r/m duration=2h size=50m;
    waf_cache capacity=100;
    waf_priority "W-IP IP W-URL URL CC ARGS UA W-REFERER REFERER COOKIE";

自定义了白名单

(?i)(?:wp-json)
(?i)(?:wp-content)
(?i)(?:wp-includes)
(?i)(?:wp-admin)

error_log如下

2021/04/23 03:44:45 [alert] 3109#3109: *132 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/04/2021-04-01_21-47.png HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/"
2021/04/23 03:44:45 [alert] 3109#3109: *133 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/01/geert-pieters-8QrPJ3Kfie4-unsplash.jpg HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/"
2021/04/23 03:44:45 [alert] 3109#3109: *134 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/02/2021020310294363.png HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/"
2021/04/23 03:44:45 [alert] 3109#3109: *135 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/03/109951165277053473.jpg HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/"
2021/04/23 03:44:45 [alert] 3109#3109: *136 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/01/2021010711333445.jpg HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/"
2021/04/23 03:44:46 [alert] 3109#3109: *137 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/01/2021011712080980.jpeg HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/"
2021/04/23 03:44:46 [alert] 3109#3109: *138 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2020/12/caelm.png HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/"

Originally created by @hibobmaster on GitHub (Apr 23, 2021). Original GitHub issue: https://github.com/ADD-SP/ngx_waf/issues/35 ![image](https://user-images.githubusercontent.com/32976627/115838629-77d74b00-a44c-11eb-931e-a7b9b95bfb71.png) ![image](https://user-images.githubusercontent.com/32976627/115838876-b1a85180-a44c-11eb-931e-e24951e06387.png) 具体表现为网站的大部分图片和部分样式返回403,F12显示MIME type全是('text/html') 换回v5.0.0版本，一切都正常 nginx -V ``` nginx version: nginx/1.19.10 built with OpenSSL 1.1.1k 25 Mar 2021 TLS SNI support enabled configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-z,relro -Wl,-z,now -fPIC' --with-openssl=/build/nginx/../openssl --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-compat --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_flv_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_mp4_module --with-http_perl_module=dynamic --with-http_random_index_module --with-http_secure_link_module --with-http_sub_module --with-http_xslt_module=dynamic --with-mail=dynamic --with-mail_ssl_module --with-stream=dynamic --with-stream_geoip_module=dynamic --with-stream_ssl_module --with-stream_ssl_preread_module --add-module=/build/nginx/sb-modules/ngx_brotli --add-dynamic-module=/build/nginx/debian/modules/http-headers-more-filter --add-dynamic-module=/build/nginx/debian/modules/http-auth-pam --add-dynamic-module=/build/nginx/debian/modules/http-cache-purge --add-dynamic-module=/build/nginx/debian/modules/http-dav-ext --add-dynamic-module=/build/nginx/debian/modules/http-ndk --add-dynamic-module=/build/nginx/debian/modules/http-echo --add-dynamic-module=/build/nginx/debian/modules/http-fancyindex --add-dynamic-module=/build/nginx/debian/modules/http-geoip2 --add-dynamic-module=/build/nginx/sb-modules/ngx_http_ipdb_module --add-dynamic-module=/build/nginx/debian/modules/nchan --add-dynamic-module=/build/nginx/debian/modules/http-lua --add-dynamic-module=/build/nginx/debian/modules/rtmp --add-dynamic-module=/build/nginx/debian/modules/http-uploadprogress --add-dynamic-module=/build/nginx/debian/modules/http-upstream-fair --add-dynamic-module=/build/nginx/debian/modules/http-subs-filter ``` 使用的配置如下 ``` waf on; waf_rule_path /etc/nginx/ngx_waf/rules/; waf_mode DYNAMIC; waf_cc_deny rate=10r/m duration=2h size=50m; waf_cache capacity=100; waf_priority "W-IP IP W-URL URL CC ARGS UA W-REFERER REFERER COOKIE"; ``` 自定义了白名单 ``` (?i)(?:wp-json) (?i)(?:wp-content) (?i)(?:wp-includes) (?i)(?:wp-admin) ``` error_log如下 ``` 2021/04/23 03:44:45 [alert] 3109#3109: *132 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/04/2021-04-01_21-47.png HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/" 2021/04/23 03:44:45 [alert] 3109#3109: *133 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/01/geert-pieters-8QrPJ3Kfie4-unsplash.jpg HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/" 2021/04/23 03:44:45 [alert] 3109#3109: *134 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/02/2021020310294363.png HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/" 2021/04/23 03:44:45 [alert] 3109#3109: *135 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/03/109951165277053473.jpg HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/" 2021/04/23 03:44:45 [alert] 3109#3109: *136 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/01/2021010711333445.jpg HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/" 2021/04/23 03:44:46 [alert] 3109#3109: *137 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2021/01/2021011712080980.jpeg HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/" 2021/04/23 03:44:46 [alert] 3109#3109: *138 ngx_waf: [WHITE-URL][(?i)(?:wp-content)], client: 173.82.212.xx, server: blog.hibobmaster.com, request: "GET /wp-content/uploads/2020/12/caelm.png HTTP/1.1", host: "blog.hibobmaster.com", referrer: "https://blog.hibobmaster.com/" ```