Assume the following setup:

enter image description here

The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization header. However when I log in the application (JWT/Bearer) which is behind NGINX, this Authorization header from NGINX is overwritten by the application's authentication token. If you refresh the page, the NGINX proxy is asking for basic authentication again.

One solution is using this: https://stackoverflow.com/a/38515091/10357380

However, I have no idea on how to append the NGINX authorization header to the application authorization header in the NGINX config file. And even if this is just appended, does it get appended each time a request is send? It will fill up the authorization header really quickly.

Has someone experience with this? Or know a different approach for the authentication part on my server?

  • What type of authorization is the app using? If it is using basic or digest authentication then maybe you should just let the app handle it and not further password protect the reverse proxy. – Stephen Ostermiller Sep 25 '18 at 15:03
  • The application itself is using JWT tokens (it puts it also in the Authorization header). – VC_work Sep 26 '18 at 12:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.