0

totally new to nginx, I am trying to implement some oauth2 web flow:

  • client ask for login,
  • the nginx I am using as reverse proxy redirects to authentication provider,
  • nginx proxyies the callback to auth provider getting the auth token with the given code,
  • client has the token.

I am not satisfied with that, I'd like to put the auth token in a httponly cookie and I bet nginx could do that but I'm not sure how... What I tried so far:

location /callback {
  proxy_method POST;
  add_header Accept application/json;
  proxy_pass https://myauthprovider?client_id=theclientid&redirect_uri=theredirecturi&client_secret=thesecret&code=$arg_code;
  add_header Set-Cookie "payload=whattoputhere?";
}

The add_header was my first try but I can't find anything to get the response body in nginx's location.
So I added the njs module and js_body_filter jwt_auth.setcookieswithtoken; to the /callback location:

location /callback {
  proxy_method POST;
  add_header Accept application/json;
  js_body_filter jwt_auth.setcookieswithtoken;
  proxy_pass https://myauthprovider?client_id=theclientid&redirect_uri=theredirecturi&client_secret=thesecret&code=$arg_code;
  add_header Set-Cookie "payload=whattoputhere?";
}

Here is the .js:

function setcookieswithtoken(req, data, flags) {
  var payload = data.split("&");
  var token = payload[0].substring(payload[0].indexOf("=") + 1);
  ngx.log(ngx.ERR, ">>>>>>token: " + token);
  ngx.log(ngx.INFO, ">>>>>>token: " + token);
//  var user = payload[2].substring(payload[2].indexOf("=") + 1);
//  ngx.log(ngx.ERR, ">>>>>>user: " + token);
  var cookies = req.headersOut['Set-Cookie'];
  cookies.push("token=" + token +"; HttpOnly; Secure");
  req.headersOut['Set-Cookie'] = cookies;
  req.sendBuffer(data, flags);
}
export default { setcookieswithtoken };

Sadly, no cookies were added to response. I also don't see any error or info message I added by ngx.log which is weird to me.. What am I missing?

Francesco
  • 1,742
  • 5
  • 44
  • 78

0 Answers0