Documentation
¶
Overview ¶
Package proxyheader implements authentication via headers injected by a trusted upstream reverse proxy (nginx, Caddy, oauth2-proxy, Cloudflare Access, Authelia, …).
The driver only honors headers when the request originates from an IP in the configured trusted_proxies CIDR set — otherwise any client could forge X-Auth-User and elevate to admin. trusted_proxies is REQUIRED; init fails if the list is empty.
On a successful header read, the user is upserted into the local users table (when auto_provision=true) and returned directly from Authenticate — no session cookie is minted, because the upstream proxy is the source of truth for every request.
Index ¶
- type Driver
- func (d *Driver) Authenticate(r *http.Request) (*model.User, error)
- func (d *Driver) Capabilities() auth.Capabilities
- func (d *Driver) Init(_ context.Context, cfg map[string]any) error
- func (d *Driver) Name() string
- func (d *Driver) Probe(_ context.Context, cfg map[string]any, r *http.Request) []auth.ProbeCheck
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Driver ¶
type Driver struct {
// contains filtered or unexported fields
}
Driver is the trusted-proxy header auth driver.
func (*Driver) Authenticate ¶
Authenticate inspects the request, validates the source IP against trusted_proxies, reads the configured headers, and resolves (or optionally provisions) a model.User.
Returns auth.ErrUnauthorized when the source is untrusted or the identity header is empty — the caller (middleware) will then fall through to the next driver.
func (*Driver) Capabilities ¶
func (d *Driver) Capabilities() auth.Capabilities
Capabilities implements auth.Driver. Header-proxy auth offers no in-band sign-in / logout — those are handled by the upstream proxy.
func (*Driver) Init ¶
Init validates configuration. trusted_proxies is REQUIRED — without it any client could spoof X-Auth-User and elevate themselves to admin.
func (*Driver) Probe ¶
Probe tests a header-trust configuration with the one request it has: the administrator's own, which reached this server either straight or through the proxy the configuration is about.
required trusted_proxies is filled in
trusted_proxies every entry is an address or a CIDR range
via_proxy this request came from one of those ranges — or, when
it came straight to filex, that is said (NOT a failure:
the test simply cannot see the proxy from here)
header a request that came through the proxy carries the
user header the configuration names
⚠ Nothing is provisioned and nobody is signed in: Authenticate would create the account the header names, so the test reads the request and never calls it.
Source Files