LeoVasanko
383c9f472e
/auth/api/forward?public=1 passes requests through with a Remote-Public header (anonymous/forbidden/authenticated) instead of 401/403, so routes can allow anonymous visitors while still identifying logged-in users. Reauth (max_age) still requires the auth flow. Documented in Headers.md, api/forward.md, Integration.md and all proxy guides.
23 lines
771 B
Plaintext
23 lines
771 B
Plaintext
# Permission to use within your endpoints that need authentication/authorization
|
|
# Argument is mandatory and provides a query string to /auth/api/forward
|
|
# "" means just authentication
|
|
# perm=yourservice:login to require specific permission
|
|
# public=1 to allow public access (backend must check Remote-Public)
|
|
forward_auth {$AUTH_UPSTREAM:localhost:4401} {
|
|
uri /auth/api/forward?{args[0]}
|
|
header_up Connection keep-alive # Much higher performance
|
|
header_up -Upgrade # Disable Upgrade: WebSocket
|
|
copy_headers {
|
|
Remote-Public
|
|
Remote-User
|
|
Remote-Name
|
|
Remote-Groups
|
|
Remote-Org
|
|
Remote-Org-Name
|
|
Remote-Role
|
|
Remote-Role-Name
|
|
Remote-Session-Expires
|
|
Remote-Credential
|
|
}
|
|
}
|