Nginx - authentication on all but the download links

[andymarden]

This is, I think a common scenario:

• Ability to create and edit shares - I need authentication so only approved users can do that
• Downloading files from a shared link - that can be open to anyone with the link

That should be relatively easy in nginx as a reverse proxy, but there is an issue in that there is an internal redirect in the service to host/com?wtd=linkid

Nginx cannot simply tell if a uri has query parameters and this gets a bit nasty with nginx's strange limitations on consditions etc.

Since this took me a while to work through, I though I would share in case anyone else is in the same boat. Note that this would be solved very simply in the back end by using a /xxx/wtd=linkid instead. Issue raised at #106 which would simplify things.

Making use of the fact that host.com redirects to /share-create, this is works (there is probably duplication of some of the set directives and it could be simplified but it works:

# Fileshelter
server {
    listen 443 ssl http2;

    server_name fileshare.example.org;

    proxy_request_buffering off;
    proxy_buffering off;
    proxy_buffer_size 4k;
    client_max_body_size 10G;

    # Share download which does not require authentication (tos too)
    location ~* /(share-download|tos|share|resources) {
      #proxy_ssl_server_name on;
      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      proxy_pass http://fileshelter.home:5091;

      proxy_read_timeout  120;
    }

    # URL is just the root one (possible with args)
    location = / {
      # redirect to /share-create if it is just the root URL with no args
      if ($args !~* "^wtd=") {
         rewrite ^ /share-create last;
      }

      # Otherwise it will be internal redirect for download 
      #proxy_ssl_server_name on;
      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      proxy_pass http://fileshelter.home:5091;

      proxy_read_timeout  120;
    }

    # Anything else and we need authentication
    location / {
      
      #proxy_ssl_server_name on;
      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto https;

      proxy_pass http://techutils.home:5091;

      proxy_read_timeout  120;

      ##############################
      # authentik-specific config
      ##############################
      auth_request     /outpost.goauthentik.io/auth/nginx;
      error_page       401 = @goauthentik_proxy_signin;
      auth_request_set $auth_cookie $upstream_http_set_cookie;
      add_header       Set-Cookie $auth_cookie;

      # translate headers from the outposts back to the actual upstream
      auth_request_set $authentik_username $upstream_http_x_authentik_username;
      auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
      auth_request_set $authentik_email $upstream_http_x_authentik_email;
      auth_request_set $authentik_name $upstream_http_x_authentik_name;
      auth_request_set $authentik_uid $upstream_http_x_authentik_uid;

      proxy_set_header X-authentik-username $authentik_username;
      proxy_set_header X-authentik-groups $authentik_groups;
      proxy_set_header X-authentik-email $authentik_email;
      proxy_set_header X-authentik-name $authentik_name;
      proxy_set_header X-authentik-uid $authentik_uid;
    }

    # all requests to /outpost.goauthentik.io must be accessible without authentication
    location /outpost.goauthentik.io {
        proxy_ssl_server_name on;
        proxy_pass              https://authentik.home:9543/outpost.goauthentik.io;

        # ensure the host of this server matches your external URL you've configured
        # in authentik
        proxy_set_header        Host $host;
        proxy_set_header        X-Original-URL $scheme://$http_host$request_uri;
        add_header              Set-Cookie $auth_cookie;
        auth_request_set        $auth_cookie $upstream_http_set_cookie;
        proxy_pass_request_body off;
        proxy_set_header        Content-Length "";
    }

    # Special location for when the /auth endpoint returns a 401,
    # redirect to the /start URL which initiates SSO
    location @goauthentik_proxy_signin {
        internal;
        add_header Set-Cookie $auth_cookie;
        return 302 /outpost.goauthentik.io/start?rd=$request_uri;
    }
}

[andymarden]

No - still doesn't work. My browser had cached files but after clearing cache I get: Fatal error: failed loading /resources/themes/bootstrap/5/bootstrap.bundle.min.js

But luckily it was simple fix - adding /resources to the no-auth section. Have modified the original post to reflect.

It now works with cleared cache done beforehand.