max-lt / nginx-jwt-module

NGINX module to check for a valid JWT.
MIT License
93 stars 38 forks source link

auth_jwt with variables does not work #32

Closed zil1 closed 1 year ago

zil1 commented 1 year ago

Hi, I'm trying to configure the jwt check depending on the request method:

http {
...
  map $request_method $jwt_validate {
          POST  on;
          default    off;
  }

  ...
  server {
    auth_jwt off;
    auth_jwt_key /etc/nginx/certs/jwt.pem file;
    ...
    location /api/ {
      auth_jwt $jwt_validate;
      ...
    }
  }
}

But I get a 401 response code with any request method

max-lt commented 1 year ago

Hello, the auth_jwt directive is parsed at config time and cannot be dynamically changed.

The auth_jwt $variable value can be used to set a custom way to get the JWT, for example to get it from a cookie instead of the default Authentication header: auth_jwt $cookie_MyCookieName;

It is not meant to be dynamically activable.

guanzo commented 1 year ago

Why not let us use dynamic variables though?

EDIT: It works with njs variables:

js_set    $jwt   auth.findJWT;
auth_jwt  $jwt;