> For the complete documentation index, see [llms.txt](https://www.axisnow.io/zh/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.axisnow.io/zh/docs/edge/policies/authn-authz/use-cases.md).

# 配置场景

认证与授权的典型配置场景与规则参数

以下是典型配置，域名、路径和声明都是示例值。规则的先后见页末的[分层](#layering)。

## 用 JWT 保护 API <a href="#protect-api" id="protect-api"></a>

调用方把从您的鉴权服务取得的 JWT 放在 `Authorization: Bearer <token>` 里调用接口。

<table data-search="false"><thead><tr><th width="140">配置项</th><th>取值</th></tr></thead><tbody><tr><td>条件</td><td>请求 Host 在以下各项之中 <code>api.example.com</code></td></tr><tr><td>动作</td><td>强制认证，认证方式为 JWT，令牌位置为请求头 <code>Authorization</code></td></tr><tr><td>授权</td><td>不写规则，默认动作 允许</td></tr></tbody></table>

AxisNow 自己的 API 就是这样保护的，完整过程见[保护对外 API 和 URL 鉴权](/zh/docs/guide/authn-authz.md#api-authentication-in-practice)。

## 按声明授权 <a href="#authorize-by-claims" id="authorize-by-claims"></a>

同一个签发方的令牌用于多个服务，或令牌里带角色时，在上一场景的规则上加授权规则，拒绝令牌合法但不该访问这个接口的调用：

<table data-search="false"><thead><tr><th width="140">配置项</th><th>取值</th></tr></thead><tbody><tr><td>授权规则 1</td><td><code>aud</code> 在以下各项之中 <code>api.example.com</code>，并且 <code>role</code> 在以下各项之中 <code>admin</code>、<code>service</code> → 允许</td></tr><tr><td>默认动作</td><td>拒绝</td></tr></tbody></table>

## 签名链接防盗链 <a href="#signed-url" id="signed-url"></a>

图片、视频、安装包的下载地址由您的后端签名并附过期时间，边缘用自定义认证重算签名并核对时效，签名不符或过期返回 401 Unauthorized。函数代码见[保护对外 API 和 URL 鉴权 › 防盗用](/zh/docs/guide/authn-authz.md#token-authentication)。

<table data-search="false"><thead><tr><th width="140">配置项</th><th>取值</th></tr></thead><tbody><tr><td>条件</td><td>请求 Host 在以下各项之中 <code>cdn.example.com</code>，并且 请求 URI 路径 开头为 <code>/video/</code></td></tr><tr><td>动作</td><td>强制认证，认证方式选自定义</td></tr></tbody></table>

## 放行内部来源 <a href="#bypass" id="bypass"></a>

健康检查、监控探针或内网调用不带凭据，在强制认证的规则前面加一条跳过认证：

<table data-search="false"><thead><tr><th width="140">配置项</th><th>取值</th></tr></thead><tbody><tr><td>条件</td><td>请求 Host 在以下各项之中 <code>api.example.com</code>，并且 请求 URI 路径 在以下各项之中 <code>/healthz</code></td></tr><tr><td>动作</td><td>跳过认证</td></tr></tbody></table>

## 分层 <a href="#layering" id="layering"></a>

同一站点跳过认证的规则排在前面，强制认证的规则按 Host 或路径前缀排在后面；不同资源要用不同认证方式或授权规则时各一条。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://www.axisnow.io/zh/docs/edge/policies/authn-authz/use-cases.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.