3

I've got a location block with an auth_request like this

location /somepath {
    auth_request /authorize;
    auth_request_set $header_variable $upstream_http_custom_header;

    proxy_path http://backendaddress;
}

What I want to do is, if the $header_variable doesn't match a particular regex I want to return a 403 code.

if isn't going to work because it runs too early. Is there anything else that would let me do this?

Glenn Slaven
  • 2,400
  • 2
  • 30
  • 42
  • Is it something like pre-validation? Why **if** conditional expression is to early? Is so, one more location with *rewrite* and condition there may help... You intend to check the header before make *auth_request*, correct? – Anatoly Aug 12 '15 at 12:32
  • if happens in the rewrite phase, I want to check the value of the variable *after* `auth_request` returns – Glenn Slaven Aug 12 '15 at 20:39
  • Did you ever find a good solution for this? I've been testing and no matter where I put my `if{}` it won't have the variable set by `auth_request_set` – Rino Bino Feb 01 '23 at 00:41

1 Answers1

1

Nginx module auth_request waits for either 200 or 401/403 HTTP code from the backend:

The ngx_http_auth_request_module module (1.5.4+) implements client authorization based on the result of a subrequest. If the subrequest returns a 2xx response code, the access is allowed. If it returns 401 or 403, the access is denied with the corresponding error code. Any other response code returned by the subrequest is considered an error.

Your request has a header that require to check for permission:

What I want to do is, if the $header_variable doesn't match a particular regex I want to return a 403 code.

During auth request/response cycle your backend needs to check the header and return 403 code to prevent next request to happen without authentication. The module auth_request works as a simple test assert which returns one of the code. It does mean backend process that is responsible for this URL to reply http://backendaddress/authorize needs to have an additional check for required header.

Anatoly
  • 566
  • 3
  • 16