Score:0

Authorization Header Missing Upon NGINX Proxy Pass to subdomain

ng flag

Hi I'm running Laravel on NGINX server and I would like to use NGINX reverse proxy capability as an API gateway for my Laravel and other node API application. Here are my configurations:

Application URL: staging-app.example.com
Application API Endpoint: staging-app.example.com/api
API Gateway URL: api.example.com

What I want to do, is to redirect all API requests api.example.com/staging-app to staging-app.example.com/api. I have succeed in redirecting the API request, but somehow the Authorization header is not passed along to the proxy pass resulting in 401 unauthorized while other header do get passed along.

Here is my current api.example.com nginx config:

server {
        server_name api.example.com;


        location /staging-app {
                rewrite ^/staging-app/(.*)$ /$1 break; 
                proxy_pass http://staging-app.example.com/;
        }

        location /test {
                rewrite ^/test/(.*)$ /$1 break;
                proxy_pass http://127.0.0.1:3333/;
         }

    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = api.example.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        listen 80;
        listen [::]:80;

        server_name api.example.com;
    return 404; # managed by Certbot
}

and for my laravel application, I use the configuration given from Laravel themselves

Update 1: I tried adding proxy_set_header Test testingvalue in the location block directly, but it doesn't seems to work either

Milan Kocic avatar
br flag
Hi, Now i have same situation. Did you solve it?
Kevin Yobeth avatar
ng flag
@MilanKocic nope, in the end I just migrate all my services to use docker and use it's bridge network instead
Ivan Shatsky avatar
gr flag
Nothing should prevent nginx to pass the `Authorization` header to your upstream. However you are not passing your request to the `/api` endpoint; to do it, use `location /staging-app { proxy_pass http://staging-app.example.com/api; }` instead. Actually, no rewrite rules are required for your configuration to strip the URI prefix at all; check [this](https://stackoverflow.com/questions/53649885/a-little-confused-about-trailing-slash-behavior-in-nginx) SO thread to find out why.
Kevin Yobeth avatar
ng flag
I have installed [telescope](https://laravel.com/docs/9.x/telescope) which allows me to see incoming requests. The request arrive successfully with the correct endpoint, but it's missing `Authorization header`. When I try adding another header such as `authorizationzz` it get passed through.
Score:0
cn flag

Try adding the following to your config for the server listetning on port 443 :

proxy_http_version 1.1;
proxy_set_header   "Connection" "";

This will make the conection from master and agents presistent which is needed for authenticaiont in some setups

config doc

nginx keep-alive doc

Kevin Yobeth avatar
ng flag
Nope the Authorization header still won't get through. I tried adding the `proxy_set_header Test testingvalue` in the location block directly, but somehow the value isn't added to the request.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.