1

The user should only be allowed access to a specific public folder if the user can be authenticated by an API server.

The public folder and API server resides on the same server running nginx 1.14 open source.

My thinking is to use ngx_http_auth_request_module to pass the authorization header to the API server that will return the result with a 200 response code when successful and 500 response code if it fails (that is the way the API is build).

But I am unsure how to implement it. Here is what I have tried but it seems the header is not passed:

location /test/ {
    auth_request /auth;
}

location = /auth {
    # I dont't know if internal; should be used. tried with and without
    internal;

    proxy_pass http://api.somedomain.dev;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
    proxy_set_header Authorization $http_authorization;

    # I also tried with and without the line below
    proxy_pass_header Authorization;
}

When I use Postman to query http://api.somedomain.dev/auth + adding Authorization header it works.

It doesn't work when I query http://api.somedomain.dev/test + adding Authorization header.

2
  • 1
    Can you expand on doesn't work ? I use internal; on my auth_request location, it's stops it being accessible to the outside world. You are removing your content length header, but not the body of the request, is your upstream going to be happy about that? You should include a proxy_pass_request_body off; directive. Aside from that your config is pretty much identical to one of mine which works fine.
    – miknik
    Jul 24 '18 at 17:50
  • @miknik Your suggestions made a difference so I could pinpoint the issue which is ridiculously simple. proxy_pass should be http://api.somedomain.dev/auth. Somewhere I read that /authwould be passed to proxy_pass but that is not true. Can you make you suggestion into an answer since it help me find the issue?
    – Cudos
    Jul 25 '18 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.