# Auth request module **URL:** \ **Category:** NGINX\ **Created:** [February 27, 2010, 8:01pm UTC](https://www.ruby-forum.com/t/auth-request-module/184273 "2010-02-27T20:01:35Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\ **Post date:** [February 27, 2010, 8:01pm UTC](https://www.ruby-forum.com/t/auth-request-module/184273/1 "2010-02-27T20:01:35Z")
Hello! Here is auth request module, it allows authorization based on subrequest result. It works at access phase and therefore may be nicely combined with other access modules (access, auth\_basic) via satisfy directive. Example usage: ``` location /private/ { auth_request /auth; ... } location = /auth { proxy_pass ... proxy_set_header X-Original-Uri $request_uri; ... } ``` To allow access backend should return 200, to disable - 401/403. Further info is here: [http://mdounin.ru/hg/ngx\_http\_auth\_request\_module/](http://mdounin.ru/hg/ngx_http_auth_request_module/) [http://mdounin.ru/files/ngx\_http\_auth\_request-0.1.tar.gz](http://mdounin.ru/files/ngx_http_auth_request-0.1.tar.gz) MD5 (ngx\_http\_auth\_request-0.1.tar.gz) = c0ed1610097017813e6468e7cca28af7 SHA256 (ngx\_http\_auth\_request-0.1.tar.gz) = ccaafc2afa4b4c98dc2b7555fc61774cfbd4f98edca87eb172ae3ec36a49f263 Maxim D. ---
**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\ **Post date:** [February 28, 2010, 7:09am UTC](https://www.ruby-forum.com/t/auth-request-module/184273/2 "2010-02-28T07:09:53Z")
On Sun, Feb 28, 2010 at 3:00 AM, Maxim D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Here is auth request module, it allows authorization based on > subrequest result. It works at access phase and therefore may be > nicely combined with other access modules (access, auth\_basic) via > satisfy directive. This is really awesome! But too sad the ngx\_eval module can’t work in subrequests itself so I can not combine this with ngx\_eval + ngx\_drizzle + ngx\_rds\_json to do mysql-based auth 🙂 It’s mostly an issue in the ngx\_eval, not your excellent ngx\_auth\_request 😉 Our ngx\_srcache module will also take advantage of subrequests to do response caching. For now, I’m using something like this for mysql-based login and it works on my machine [1]: location = /auth { default\_type ‘application/json’; eval\_subrequest\_in\_memory off; eval $res { set\_quote\_sql\_str $user $arg\_user; set\_quote\_sql\_str $pass $arg\_pass; set $sql ‘select count(\*) res from users where name=$user and passwd=$pass’; drizzle\_query $sql; drizzle\_pass backend; rds\_json on; rds\_json\_content\_type application/octet-stream; } if ($res ~ ‘“res”:1’) { echo “Cool! you’re already logged in!”; } if ($res !~ ‘“res”:1’) { return 403; } } where the “backend” upstream name used in the drizzle\_pass directive is defined like this: ``` upstream backend { drizzle_server 127.0.0.1:3306 dbname=test password=some_pass user=monty protocol=mysql; drizzle_keepalive max=400 overflow=reject; } ``` Then we can login the system by GET /auth?user=john&pass=some\_pass. Well, it’s just a naive demonstration. Hopefully I’m not too OT 😛 Cheers, -agentzh [1] Here we’re using my fork of ngx\_eval module ( [GitHub - openresty/nginx-eval-module: A module for evaluating memcached or proxy response into variable · GitHub](http://github.com/agentzh/nginx-eval-module) ) for two important features: 1) capture outputs from arbitrary locations with output filter support, 2) pass the parent request’s query string (or “args”) into the eval block. ---
**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\ **Post date:** [March 1, 2010, 10:36am UTC](https://www.ruby-forum.com/t/auth-request-module/184273/3 "2010-03-01T10:36:44Z")
----- “agentzh” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > But too sad the ngx\_eval module can’t work in subrequests itself so I > can not combine this with ngx\_eval + ngx\_drizzle + ngx\_rds\_json to do > mysql-based auth 🙂 > > It’s mostly an issue in the ngx\_eval, not your excellent > ngx\_auth\_request 😉 What kind of issue is it? – Regards, Valery K. ---
**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\ **Post date:** [March 11, 2010, 6:05pm UTC](https://www.ruby-forum.com/t/auth-request-module/184273/4 "2010-03-11T18:05:04Z")
Spassiba Maxim ! Can we consume request body both in : - /auth url - and the latter private url Best Marc Posted at Nginx Forum: > **[Re: \[ANNOUNCE\] auth request module](https://forum.nginx.org/read.php?2,58047,62778#msg-62778)** > > Hello! Here is auth request module, it allows authorization based on subrequest result. It works at access phase and therefore may be nicely combined with other access modules (access, auth\_basic) via satisfy directive. Example usage: ---
**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\ **Post date:** [March 11, 2010, 12:51pm UTC](https://www.ruby-forum.com/t/auth-request-module/184273/5 "2010-03-11T12:51:14Z")
On Mon, Mar 1, 2010 at 4:45 PM, Valery K. \>\> It’s mostly an issue in the ngx\_eval, not your excellent > > ngx\_auth\_request 😉 > > What kind of issue is it? ngx\_eval cannot be used in subrequests. Consider the following example: ``` location /foo { add_before_body /bah; #echo_location_async /bah; echo done; } location /bah { eval $foo { proxy_pass $scheme://127.0.0.1:$server_port/baz; } echo [$foo]; } location /baz { echo baz; } ``` Accessing /bah gives the correct output (using the git HEAD of your repos): ``` [baz] ``` But accessing /foo results in a segfault. Here’s the gdb output: Program received signal SIGSEGV, Segmentation fault. memcpy () at ../sysdeps/i386/i686/memcpy.S:100 100 ../sysdeps/i386/i686/memcpy.S: No such file or directory. in ../sysdeps/i386/i686/memcpy.S Current language: auto The current source language is “auto; currently asm”. (gdb) bt #0 memcpy () at ../sysdeps/i386/i686/memcpy.S:100 #1 0x0804fb6e in ngx\_vslprintf (buf=0x3ffffafa \
, last=0xbffff3ac “\005”, fmt=0x80aaa1c “V?%V"”, args=0xbffff3e4 “”) at /usr/include/bits/string3.h:52 #2 0x0804be81 in ngx\_log\_error\_core (level=805306387, log=0x80c6258, err=527676, fmt=0x64000000 \
) at src/core/ngx\_log.c:119 #3 0x88000075 in ?? () Backtrace stopped: previous frame inner to this frame (corrupt stack?) By using ngx\_echo module’s echo\_location\_async to issue the subrequest gives identical segfault 🙂 I haven’t tracked deep into the source but at least the lines starting from ngx\_http\_eval\_module.c:141 don’t like subrequests’ contexts. Sorry for the delay. I was in Hangzhou for other business in the last few weeks 😛 Cheers, -agentzh ---
**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\ **Post date:** [March 11, 2010, 6:37pm UTC](https://www.ruby-forum.com/t/auth-request-module/184273/6 "2010-03-11T18:37:17Z")
Hello! On Thu, Mar 11, 2010 at 12:04:14PM -0500, amvtek wrote: > Spassiba Maxim ! > > Can we consume request body both in : > > - /auth url > - and the latter private url Short answer: no Long answer: Currently request body isn’t read by auth request. In fact it specially prevents this from happening, as an attempt to read request body from subrequest will cause SIGSEGV - nginx doesn’t expect this to happen. Moreover, as of now request body may be used only once if it doesn’t fit into memory, as first successful upstream request will close temporary file used to buffer it. This may even cause problems in nginx with official modules (e.g. ssi returned by backend and ssi subrequests). I’m not sure how to fix this properly. For now I tend to think that only main request should be allowed to work with request body and subrequest should always ignore it. Maxim D. ---
**Author:** ![Maxim\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/da6949/32.png) [@Maxim\_D](https://www.ruby-forum.com/u/Maxim_D)\ **Post date:** [March 12, 2010, 9:14am UTC](https://www.ruby-forum.com/t/auth-request-module/184273/7 "2010-03-12T09:14:47Z")
Thanks Maxim, I think I get it now, request ‘body’ can be consumed at most one time, this is a design decision which aims at protecting system ressources. Best, Marc Posted at Nginx Forum: > **[Re: \[ANNOUNCE\] auth request module](https://forum.nginx.org/read.php?2,58047,62990#msg-62990)** > > Hello! Here is auth request module, it allows authorization based on subrequest result. It works at access phase and therefore may be nicely combined with other access modules (access, auth\_basic) via satisfy directive. Example usage: