Assume the following setup:

enter image description here

The NGINX reverse proxy is asking for basic authentication (which is a good habit when you expose things on the internet). Basic authentication uses the Authorization header. However when I log in the application (JWT/Bearer) which is behind NGINX, this Authorization header from NGINX is overwritten by the application's authentication token. If you refresh the page, the NGINX proxy is asking for basic authentication again.

One solution is using this: https://stackoverflow.com/a/38515091/10357380

However, I have no idea on how to append the NGINX authorization header to the application authorization header in the NGINX config file. And even if this is just appended, does it get appended each time a request is send? It will fill up the authorization header really quickly.

Has someone experience with this? Or know a different approach for the authentication part on my server?

  • What type of authorization is the app using? If it is using basic or digest authentication then maybe you should just let the app handle it and not further password protect the reverse proxy. Sep 25, 2018 at 15:03
  • The application itself is using JWT tokens (it puts it also in the Authorization header).
    – VC_work
    Sep 26, 2018 at 12:20


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.