nginx proxy request to service with header value from an authentication http request

Question

This is what I'd like to achieve:

I want to use nginx as a classic reverse proxy to expose server's resources. Before calling the server, nginx should ask a token to the token issuer (an internal service) and inject this token into the authentication header of the call towards the server.

Is it possibile to achieve this with nginx? I looked around inside the nginx documentation and I know I can use proxy_set_header to modify the headers being proxied to the server.

Update

I was able to make the solution below work; here is a POC on github

I don't find an example in which I take the response from the subrequest and "inject" it into the proxied request. — Luca Marzi
– Luca Marzi, Commented Nov 16, 2020 at 15:30
How does the token issuer returns the token? In the response body or via some HTTP header? In second case you can use the auth_request_set directive. — Ivan Shatsky
– Ivan Shatsky, Commented Nov 16, 2020 at 15:36
That's up to me. I'd prefer to keep it in the body, but I can still live with the fact it is returned as part of the response header. — Luca Marzi
– Luca Marzi, Commented Nov 16, 2020 at 15:57

Ivan Shatsky · Accepted Answer · 2020-11-21 01:22:48Z

5

If you can make your token issuer to return the token via some HTTP header, for example the X-JWT-Token, here is an example that should work for you:

location /auth {
    internal;
    proxy_pass http://token-issuer;
    proxy_pass_request_body off;
    proxy_set_header Content-Length 0;
    # You can pass an additional data for the token issuer, for example
    # proxy_set_header X-Original-URI $request_uri;
}
location / {
    auth_request /auth;
    auth_request_set $token $upstream_http_x_jwt_token;
    proxy_set_header Authorization "Bearer $token";
    proxy_pass http://upstream;
}

edited Nov 21, 2020 at 1:22

answered Nov 16, 2020 at 16:21

Ivan Shatsky

16.2k3 gold badges28 silver badges54 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Luca Marzi Over a year ago

It works; what if I'd like the token to be returned inside the token-issuer body?

Ivan Shatsky Over a year ago

@LucaMarzi I don't know if it is possible with the vanilla nginx at all (if you'd manage to find such solution, please share it with the others). It can be possible with the third party modules that support subrequests (using njs via ngx_http_js_module (example) or via lua-nginx-module using the ngx.location.capture function).

Luca Marzi Over a year ago

I created this POC on github to test the solution above.

Collectives™ on Stack Overflow

nginx proxy request to service with header value from an authentication http request

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related