> For the complete documentation index, see [llms.txt](https://www.axisnow.io/zh/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.axisnow.io/zh/docs/edge/policies/authn-authz.md).

# 认证与授权

在边缘校验请求凭据并按身份决定放行

认证与授权（Authentication & Authorization）在边缘校验请求携带的凭据，并按凭据里的身份决定放行或拒绝，不合法和越权的请求不到源站。认证方式有两种：

* **JWT**：由边缘验签。
* **自定义**：由您在[边缘运行时](/zh/docs/edge/policies/edge-runtime.md)里写的函数判定。

## 位置 <a href="#position" id="position"></a>

<table data-search="false"><thead><tr><th width="200">相邻的插件</th><th>关系</th></tr></thead><tbody><tr><td><a href="/zh/docs/edge/policies/real-ip.md">真实客户端 IP</a>（之前）</td><td>条件和认证失败封禁用的「客户端 IP 地址」取它还原出的真实地址</td></tr><tr><td><a href="/zh/docs/edge/policies/request-processing.md">请求处理</a>（之后）</td><td>认证失败的请求不会走到重定向和边缘响应</td></tr><tr><td><a href="/zh/docs/edge/policies/access-control.md">通用访问控制</a>、<a href="/zh/docs/edge/policies/rate-limiting.md">速率控制</a>（之后）</td><td>认证失败的请求不进入这两个插件；认证通过的请求是否进入由<a href="/zh/docs/edge/policies/authn-authz/how-it-works.md#controls">附加控制</a>决定</td></tr></tbody></table>

三个安全插件的分工：认证与授权按身份，通用访问控制按请求特征，速率控制按频率。TCP 转发端点没有凭据可校验，命中强制认证的规则按配置错误放行。

## 规则 <a href="#rules" id="rules"></a>

它是[安全类插件](/zh/docs/edge/policies/rules.md#rulesets)，但与通用访问控制不同，**跳过认证**命中即结束本插件，不再匹配后面的规则。动作二选一：**强制认证**引用一个认证方式，**跳过认证**让命中的请求不经认证直接放行。没有内置规则，没有规则命中的请求不做认证。

## 边界 <a href="#boundaries" id="boundaries"></a>

<table data-search="false"><thead><tr><th width="260">功能</th><th>配置位置</th></tr></thead><tbody><tr><td>校验客户端证书（mTLS）</td><td><a href="/zh/docs/edge/policies/ssl-tls/configuration.md#client-mtls">SSL/TLS › 客户端 mTLS</a></td></tr><tr><td>按 IP、地区、路径等请求特征拦截</td><td><a href="/zh/docs/edge/policies/access-control.md">通用访问控制</a></td></tr><tr><td>按请求频率限制</td><td><a href="/zh/docs/edge/policies/rate-limiting.md">速率控制</a></td></tr><tr><td>自定义认证函数的 API 与限制</td><td><a href="/zh/docs/edge/policies/edge-runtime.md">边缘运行时</a></td></tr></tbody></table>

## 最佳实践 <a href="#best-practices" id="best-practices"></a>

* **用授权规则限定签发方和受众**：认证只验签名，不校验签发方和受众。同一个 IdP 为多个服务签发的令牌，拿着给别的服务签的令牌也能通过认证；在授权规则里要求 `iss` 为您的签发方、`aud` 为本服务，默认动作设为拒绝。
* **登录和刷新令牌的接口加一条跳过认证**：强制认证按 Host 覆盖整个 API 时，换取令牌的接口本身没有令牌可带，会一直返回 401 Unauthorized。把 `/login`、`/token` 这类路径放在前面的跳过认证规则里。
* **JWKS 地址要能从边缘访问，轮换先发布后使用**：边缘节点按地址拉取 JWKS，内网的 IdP 要对边缘出口 IP 开放。新密钥先加入 JWKS（或与旧公钥并列填入），等过了刷新周期再用它签发；旧密钥保留到用它签发的令牌全部过期。周期见[工作原理 › JWT](/zh/docs/edge/policies/authn-authz/how-it-works.md#jwt)。
* **要对已认证的调用限速，先关闭绕过**：强制认证的规则默认开启绕过通用访问控制和绕过速率控制，持有合法凭据的调用不会进入限速。要限制调用频率，在规则上关闭绕过速率控制，限速规则按客户端 IP 或 `Authorization` 请求头计数即按调用方区分。
* **认证失败封禁的阈值要高于客户端的重试频率**：令牌过期后自动重试的客户端，失败次数在窗口内达到上限一样会被封。有重试逻辑的接口把次数调高或封禁时长缩短。

## 下一步 <a href="#next-steps" id="next-steps"></a>

<table data-search="false"><thead><tr><th width="160">页面</th><th>内容</th></tr></thead><tbody><tr><td><a href="/zh/docs/edge/policies/authn-authz/how-it-works.md">工作原理</a></td><td>评估顺序、JWT 校验细节、授权规则、失败响应与附加控制、日志字段</td></tr><tr><td><a href="/zh/docs/edge/policies/authn-authz/use-cases.md">配置场景</a></td><td>保护 API、按声明授权、签名链接防盗链、放行内部来源</td></tr><tr><td><a href="/zh/docs/edge/policies/authn-authz/faq.md">常见问题</a></td><td>401 与 403、令牌被拒、密钥轮换、预检请求、误封</td></tr><tr><td><a href="/zh/docs/guide/authn-authz.md">保护对外 API 和 URL 鉴权</a></td><td>AxisNow 自己如何用 JWT 保护 API，以及防盗链、防 CC 的实践</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://www.axisnow.io/zh/docs/edge/policies/authn-authz.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.