totally new to nginx, I am trying to implement some oauth2 web flow:
- client ask for login,
- the nginx I am using as reverse proxy redirects to authentication provider,
- nginx proxyies the callback to auth provider getting the auth token with the given code,
- client has the token.
I am not satisfied with that, I'd like to put the auth token in a httponly cookie and I bet nginx could do that but I'm not sure how... What I tried so far:
location /callback {
proxy_method POST;
add_header Accept application/json;
proxy_pass https://myauthprovider?client_id=theclientid&redirect_uri=theredirecturi&client_secret=thesecret&code=$arg_code;
add_header Set-Cookie "payload=whattoputhere?";
}
The add_header
was my first try but I can't find anything to get the response body in nginx's location.
So I added the njs
module and js_body_filter jwt_auth.setcookieswithtoken;
to the /callback
location:
location /callback {
proxy_method POST;
add_header Accept application/json;
js_body_filter jwt_auth.setcookieswithtoken;
proxy_pass https://myauthprovider?client_id=theclientid&redirect_uri=theredirecturi&client_secret=thesecret&code=$arg_code;
add_header Set-Cookie "payload=whattoputhere?";
}
Here is the .js:
function setcookieswithtoken(req, data, flags) {
var payload = data.split("&");
var token = payload[0].substring(payload[0].indexOf("=") + 1);
ngx.log(ngx.ERR, ">>>>>>token: " + token);
ngx.log(ngx.INFO, ">>>>>>token: " + token);
// var user = payload[2].substring(payload[2].indexOf("=") + 1);
// ngx.log(ngx.ERR, ">>>>>>user: " + token);
var cookies = req.headersOut['Set-Cookie'];
cookies.push("token=" + token +"; HttpOnly; Secure");
req.headersOut['Set-Cookie'] = cookies;
req.sendBuffer(data, flags);
}
export default { setcookieswithtoken };
Sadly, no cookies were added to response. I also don't see any error or info message I added by ngx.log
which is weird to me.. What am I missing?