# Nginx & Digest authentication

**URL:** <https://www.ruby-forum.com/t/nginx-digest-authentication/242959>\
**Category:** NGINX\
**Created:** [August 11, 2015, 5:35am UTC](https://www.ruby-forum.com/t/nginx-digest-authentication/242959 "2015-08-11T05:35:50Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [August 11, 2015, 5:35am UTC](https://www.ruby-forum.com/t/nginx-digest-authentication/242959/1 "2015-08-11T05:35:50Z")

</div>

I have a NGINX that sits in front of my application. I have digest  
authentication enabled for the application. Id like a set up where when  
a user connects to NGINX using Digest, NGINX simply proxies this request  
to my application where the actual authentication happens. The  
authentication logic is already available in the application and I just  
want the NGINX to forward the headers correctly to the app.

Could someone help me on how to accomplish this?

Regards,  
Arun

---

<div class="post-metadata">

**Author:** ![Arun\_John\_Sarujohn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/d07c76/32.png) [@Arun\_John\_Sarujohn](https://www.ruby-forum.com/u/Arun_John_Sarujohn)\
**Post date:** [August 11, 2015, 3:10pm UTC](https://www.ruby-forum.com/t/nginx-digest-authentication/242959/2 "2015-08-11T15:10:06Z")

</div>

Hello!

On Tue, Aug 11, 2015 at 03:35:19AM +0000, Arun John (arujohn) wrote:

> I have a NGINX that sits in front of my application. I have  
> digest authentication enabled for the application. I’d like a  
> set up where when a user connects to NGINX using Digest, NGINX  
> simply proxies this request to my application where the actual  
> authentication happens. The authentication logic is already  
> available in the application and I just want the NGINX to  
> forward the headers correctly to the app.
> 
> Could someone help me on how to accomplish this?

Just use proxy\_pass, see [Module ngx\_http\_proxy\_module](http://nginx.org/r/proxy_pass).

–  
Maxim D.

> **[nginx](http://nginx.org/)**

---

<div class="post-metadata">

**Author:** ![Arun\_John\_Sarujohn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/d07c76/32.png) [@Arun\_John\_Sarujohn](https://www.ruby-forum.com/u/Arun_John_Sarujohn)\
**Post date:** [August 11, 2015, 3:30pm UTC](https://www.ruby-forum.com/t/nginx-digest-authentication/242959/3 "2015-08-11T15:30:33Z")

</div>

Hi,

Thanks for the suggestion. I tried using proxy\_pass, but it didnt help  
much.

Please find my settings

upstream my\_backend {  
server 127.0.0.1:8083;  
}

location / {

proxy\_pass http://my\_backend;

proxy\_set\_header Host $host;  
proxy\_set\_header X-Real-IP $remote\_addr;  
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
proxy\_set\_header X-Forwarded-Proto http;  
proxy\_pass\_request\_headers on;

```
       if ($request_method = GET ) {
          rewrite ^/(perf-log-.+)$ /uploads/perf/$1 break;
          root /opt/test/files;

```

}

```
   }

```

Is there any issue with my configs?

Regards,  
Arun

On 8/11/15, 6:39 PM, “nginx on behalf of Maxim D.”

---

<div class="post-metadata">

**Author:** ![Arun\_John\_Sarujohn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/d07c76/32.png) [@Arun\_John\_Sarujohn](https://www.ruby-forum.com/u/Arun_John_Sarujohn)\
**Post date:** [August 11, 2015, 3:50pm UTC](https://www.ruby-forum.com/t/nginx-digest-authentication/242959/4 "2015-08-11T15:50:25Z")

</div>

Hi Edho,

The get requests were failing and nginx was not forwarding the headers  
required for the authentication. The result was same as before. I have  
shared the configs. May be I am missing some minor configurations?

When I switch the nginx off and directly access the application,  
everything works fine and able to authenticate.

Regards,  
Arun

On 8/11/15, 7:06 PM, “nginx on behalf of Edho A.”

---

<div class="post-metadata">

**Author:** ![Arun\_John\_Sarujohn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/d07c76/32.png) [@Arun\_John\_Sarujohn](https://www.ruby-forum.com/u/Arun_John_Sarujohn)\
**Post date:** [August 11, 2015, 3:37pm UTC](https://www.ruby-forum.com/t/nginx-digest-authentication/242959/5 "2015-08-11T15:37:34Z")

</div>

On Tue, Aug 11, 2015 at 10:29 PM, Arun John (arujohn)  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hi,
> 
> Thanks for the suggestion. I tried using proxy\_pass, but it didn¹t help  
> much.

I think it would help if you explain the problem in more detail than  
just “didn’t help much”.

---

<div class="post-metadata">

**Author:** ![Arun\_John\_Sarujohn](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/d07c76/32.png) [@Arun\_John\_Sarujohn](https://www.ruby-forum.com/u/Arun_John_Sarujohn)\
**Post date:** [August 11, 2015, 7:43pm UTC](https://www.ruby-forum.com/t/nginx-digest-authentication/242959/6 "2015-08-11T19:43:32Z")

</div>

Hello!

On Tue, Aug 11, 2015 at 01:49:37PM +0000, Arun John (arujohn) wrote:

> The “get” requests were failing and nginx was not forwarding the headers  
> required for the authentication. The result was same as before. I have  
> shared the configs. May be I am missing some minor configurations?

Please define “the headers required for the authentication”. If  
you think some headers are not passed, it would be good idea to  
look into what happens on the wire to be specific. Debug log  
should be enough to see detailed info about headers send/received,  
see here:

> **[A debugging log](http://nginx.org/en/docs/debugging_log.html)**

Altrenatively, you can use tcpdump to see what actually happens on  
the wire.

Note though, that Digest authentication can be easily screwed up  
by URI changes. Your configuration suggests that you are trying  
to change some URIs. Make sure you aren’t testing with these URIs  
you are trying to change. Or, better yet, try with just  
proxy\_pass and nothing more, as initially suggested.

–  
Maxim D.

> **[nginx](http://nginx.org/)**