反向代理多次刷新或者直接url请求，会出现444错误

[astralwaveio]

联系方式

[email protected]

1Panel 版本

v1.10.6-lts

问题描述

[BUG]反向代理多次刷新或者直接url请求，会出现444错误

重现步骤

1.1、假设 https://panel.domain.com/settings/about
1.2、删除 /settings/about 后剩下 https://panel.domain.com 回车会出现
1.3、重新输入 https://panel.domain.com/[安全码] 还是无法进入，重启服务器会好

2.1、快速！强制！刷新页面 N 次也会出现

期待的正确结果

理论上应该都返回200 才对。

相关日志输出

111.0.xxx.xx - - [07/May/2024:22:35:15 +0800] "POST /api/v1/settings/search HTTP/2.0" 200 1673 "https://panel.domain.com/hosts/monitor/monitor" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:15 +0800] "GET /api/v1/hosts/monitor/netoptions HTTP/2.0" 200 192 "https://panel.domain.com/hosts/monitor/monitor" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:15 +0800] "POST /api/v1/settings/search HTTP/2.0" 200 1673 "https://panel.domain.com/hosts/monitor/monitor" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:15 +0800] "GET /api/v1/licenses/get/status HTTP/2.0" 200 62 "https://panel.domain.com/hosts/monitor/monitor" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:15 +0800] "GET /public/favicon.png HTTP/2.0" 444 0 "https://panel.domain.com/hosts/monitor/monitor" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:15 +0800] "POST /api/v1/hosts/monitor/search HTTP/2.0" 444 0 "https://panel.domain.com/hosts/monitor/monitor" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:17 +0800] "GET /assets/css/index-58fe6439.css HTTP/2.0" 444 0 "https://panel.domain.com/hosts/monitor/monitor" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:17 +0800] "GET /assets/js/index-32425f1b.js HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:17 +0800] "GET /assets/css/table-column-5d9b8d93.css HTTP/2.0" 444 0 "https://panel.domain.com/hosts/monitor/monitor" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:17 +0800] "GET /assets/css/checkbox-9b4de123.css HTTP/2.0" 444 0 "https://panel.domain.com/hosts/monitor/monitor" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:17 +0800] "GET /assets/css/switch-6cf08487.css HTTP/2.0" 444 0 "https://panel.domain.com/hosts/monitor/monitor" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:17 +0800] "GET /assets/js/no_app-68a0aee4.js HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:17 +0800] "GET /assets/js/index-d9e85645.js HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:17 +0800] "GET /assets/js/form-item-d76e7d20.js HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:17 +0800] "GET /assets/js/form-rules-f31196dd.js HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:26 +0800] "GET /assets/css/table-235e538b.css HTTP/2.0" 444 0 "https://panel.domain.com/hosts/monitor/monitor" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:26 +0800] "GET /assets/js/index-11363987.js HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
111.0.xxx.xx - - [07/May/2024:22:35:26 +0800] "GET /assets/js/index-cf7614e3.js HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"

附加信息

目前晚上查到 宝塔面板有三方防火墙导致，但是这个是偶发的，不是必然，我认为不是防火墙导致，可能是 docker 程序 bug？

[astralwaveio]

日志为源日志，域名及IP进行了脱敏处理

[wan92hen]

可以看下防火墙的拦截记录，看起来是被频率限制规则拦截掉了。

[astralwaveio]

关闭所有防火墙，放行所有ip与端口，卸载重新安装1panel，依然如此，完全不知道是什么地方拦截的，折腾一晚上，目前依然无法解决，怀疑是高级功能或者1panel内部逻辑bug导致

[fishcpy]

我遇到了这种情况，同时用大量测速节点访问就会有444，我目前的解决方法是把WAF里的全局设置关掉