1

I need to route every request to 2 upstreams one after another (1st auth-server, 2nd misc-server). 1st upstream may or may not add headers and may/ may not alter request body.

Upstreams API can be POST/GET

Can we do something like below with nginx:

    upstream auth-server {
        server localhost:8800 weight=5;
    }
    upstream misc-server {
        server localhost:8800 weight=5;
    }

    server {    
    location /misc {
        proxy_pass http://auth-server/misc/auth/pre; #1st route to this
    }
    location /misc {
        proxy_pass http://misc-server/misc; #2nd route to this
    }

}

The reason I'm trying to achieve this is for request validation by 1st upstream ie auth-server before actually routing request to destination upstream ie misc-server. Is this advisable?

Improve this question
8
  • This is a terrible application design. It should not be done at all in a production app. The app server cannot be sure that the user is authenticated or authorized, because it was bypassed. That said, you can probably pull some dirty trick with the third-party lua module.
    – Michael Hampton
    Commented Feb 5, 2021 at 13:21
  • @MichaelHampton all I want is to decouple authorization logic from multiple microservices so I decided to create a upstream and have it PRE-PROCESS all requests. In case, this auth upsteam fails to validate a request, it wont be send to misc-upstream by nginx. Still terrible?
    – Sachin Verma
    Commented Feb 5, 2021 at 13:33
  • Yes, it's terrible. It is not nginx that needs to authenticate and authorize the user, but your other microservices. Those other microservices, not nginx, should be talking to your auth microservice. It is not possible to simply trust the external environment has authenticated the user correctly. What if someone bypassed nginx and was able to talk to your microservice directly? They could fake authentication and do anything.
    – Michael Hampton
    Commented Feb 5, 2021 at 13:36
  • @MichaelHampton how about I put one nginx in DMZ and one nginx in prod and have nginx do autorization via lua?
    – Sachin Verma
    Commented Feb 5, 2021 at 13:51
  • Are you serious?
    – Michael Hampton
    Commented Feb 5, 2021 at 14:02

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .