# Authorization header in combination with X-Accel-Redirect

**URL:** <https://www.ruby-forum.com/t/authorization-header-in-combination-with-x-accel-redirect/186919>\
**Category:** NGINX\
**Created:** [April 14, 2010, 11:33am UTC](https://www.ruby-forum.com/t/authorization-header-in-combination-with-x-accel-redirect/186919 "2010-04-14T11:33:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![plantian](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b4bc9f/32.png) [@plantian](https://www.ruby-forum.com/u/plantian)\
**Post date:** [April 14, 2010, 11:33am UTC](https://www.ruby-forum.com/t/authorization-header-in-combination-with-x-accel-redirect/186919/1 "2010-04-14T11:33:52Z")

</div>

I have one proxy that is handling Authorization of users for media  
content. This proxy really does authorize users, returning 403 if they  
are not permitted to access a resource. Then I proxy to amazon s3 to a  
private bucket. In order to authenticate _myself_ I need to pass an  
Authorization header to amazon s3. The name of the header is misleading  
because really this is authentication. Is there any way to return that  
header in the response from first proxy while returning X-Accel-Redirect  
and have it passed to the second proxy?

I’ve tried setting Authorization in my first proxy and then setting  
proxy\_pass\_header Authorization in the location of the second proxy but  
it is never passed. Is there any way to do this?

As a hack I’ve successfully set a query argument in X-Accel-Redirect  
that I then extract and use to set the Authorization header. This  
doesn’t seem right but its working for some reason.

Thanks.

-Ian

Posted at Nginx Forum:

> **[Authorization header in combination with X-Accel-Redirect](https://forum.nginx.org/read.php?2,74809,74809#msg-74809)**
>
> I have one proxy that is handling Authorization of users for media content. This proxy really does authorize users, returning 403 if they are not permitted to access a resource. Then I proxy to amazon s3 to a private bucket. In order to authenticate...

---

<div class="post-metadata">

**Author:** ![plantian](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b4bc9f/32.png) [@plantian](https://www.ruby-forum.com/u/plantian)\
**Post date:** [April 14, 2010, 12:14pm UTC](https://www.ruby-forum.com/t/authorization-header-in-combination-with-x-accel-redirect/186919/2 "2010-04-14T12:14:15Z")

</div>

Hello!

On Wed, Apr 14, 2010 at 05:33:10AM -0400, plantian wrote:

> I have one proxy that is handling Authorization of users for  
> media content. This proxy really does authorize users,  
> returning 403 if they are not permitted to access a resource.  
> Then I proxy to amazon s3 to a private bucket. In order to  
> authenticate _myself_ I need to pass an Authorization header to  
> amazon s3. The name of the header is misleading because really  
> this is authentication. Is there any way to return that header  
> in the response from first proxy while returning  
> X-Accel-Redirect and have it passed to the second proxy?

So you don’t have Authorization header in original request but  
want to add it to proxied request to s3, right?

Solution is to return header content in some custom header from  
you redirect script (e.g. X-Auth) and then set it in  
request to s3 via proxy\_set\_header. Tricky part is to extract it from  
$upstream\_http\_x\_auth variable before it will be cleared by next  
proxy request - this requires an extra “set”.

```
location /files/ {
    # backend which returns X-Accel-Redirect and X-Auth
    # headers

    proxy_pass ...
}

location /s3/ {
    # proxy to s3

    internal;
    proxy_pass ...

    set $xauth $upstream_http_x_auth;

    proxy_set_header Authorization $xauth;
}

```

> I’ve tried setting Authorization in my first proxy and then  
> setting proxy\_pass\_header Authorization in the location of the  
> second proxy but it is never passed. Is there any way to do  
> this?

Directive “proxy\_pass\_header” is to pass headers from backend to  
client (make sense for headers which are normally hidden, like  
X-Accel-Redirect). It has nothing to do with headers sent to  
upstream servers.

> As a hack I’ve successfully set a query argument in  
> X-Accel-Redirect that I then extract and use to set the  
> Authorization header. This doesn’t seem right but its working  
> for some reason.

See above for better solution.

Maxim D.

---

<div class="post-metadata">

**Author:** ![plantian](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b4bc9f/32.png) [@plantian](https://www.ruby-forum.com/u/plantian)\
**Post date:** [April 14, 2010, 9:31pm UTC](https://www.ruby-forum.com/t/authorization-header-in-combination-with-x-accel-redirect/186919/3 "2010-04-14T21:31:04Z")

</div>

## Maxim D. Wrote:

> access a resource.
> 
> > X-Accel-Redirect and have it passed to the  
> > request to s3 via proxy\_set\_header. Tricky part  
> > proxy\_pass …  
> > proxy\_set\_header Authorization $xauth;  
> > Directive “proxy\_pass\_header” is to pass headers  
> > from backend to  
> > client (make sense for headers which are normally  
> > hidden, like  
> > X-Accel-Redirect). It has nothing to do with  
> > headers sent to  
> > upstream servers.

This makes sense now, thank you very much.

> Maxim D.
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx)

It works flawlessly, thanks.

-Ian

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,74809,75012#msg-75012](http://forum.nginx.org/read.php?2,74809,75012#msg-75012)