记录一次联通cdn劫持的请求响应报文

背景

七牛云存储的一个js文件，很长时间没有个更新。（仅限于联通的网络）最近发现已经被替换，替换之后大概的结构类似于

1. load 之前的文件
2. 加载一个第三方的js（混淆之后的并没有看懂）

然而，在第一步的过程中使用http请求，从而导致请求失败，才得以发现这次的劫持。

请求头

GET /statics/components/sys-man/role-man-detail.controller.e00c1331.js HTTP/1.1
Host: 马赛克
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: 马赛克
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

联通响应头

这可以看到直接从 cdn cache server中返回结果，

HTTP/1.1 200 OK
Server: nginx/1.2.2
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 761
Content-Type: text/html
X-Via: 1.1 PShnaywtye146:4 (Cdn Cache Server V2.0), 1.1 zhouwangtong133:1 (Cdn Cache Server V2.0)
Connection: keep-alive
X-Dscp-Value: 03

移动响应头

移动环境下是正确的

HTTP/1.1 200 OK
Date: Thu, 03 May 2018 06:35:03 GMT
Server: nginx
Content-Type: application/javascript
Content-Length: 1174
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-Log, X-Reqid
Access-Control-Max-Age: 2592000
Cache-Control: public, max-age=31536000
Content-Disposition: inline; filename="role-man-detail.controller.e00c1331.js"; filename*=utf-8' 'role-man-detail.controller.e00c1331.js
Content-Encoding: gzip
Content-Transfer-Encoding: binary
ETag: "FtSb8MHf6mZNnUsIMy5NAbW_mVN5.gz"
Last-Modified: Fri, 22 Dec 2017 06:39:04 GMT
X-Log: mc.g;0s.gh;PFDS;AUTHPROXY_jjh_out:3;IO:6
X-Reqid: CG4AAGezPRYGBSsV
X-Svr: IO
X-Qiniu-Zone: 0
X-Via: 1.1 tandianxin87:5 (Cdn Cache Server V2.0), 1.1 zhdxxz12:7 (Cdn Cache Server V2.0)
Connection: keep-alive
X-Dscp-Value: 0