Authorization using reverse proxy

Usage of the reverse proxy makes authorization quite simple. This simple code shows implementation of several authorization methods. It is inspired by the following things:

• Basic reverse proxy
• This Gist

Token based authorization

This is a very simple authorisation based on the string token, shared between proxy and client. The token is submitted as a header auth-token. The implementation of handler is here. The main defines proxy parameters, and starts the proxy server using handler.

To test it execute:

curl http://localhost:9090/foo

returns Unauthorised

If you use a proper token:

curl http://localhost:9090/hello -H "auth-token: 12345"

the request will be forwarded to the actial server

Basic authorization

This is a very simple authorisation based on the user name/password, shared between proxy and client. The credentials are submitted using a standard basic auth header Authorization. The implementation of handler ishere. The main defines proxy parameters, and starts the proxy server using handler.

To test it execute:

curl http://localhost:9090/foo

returns Unauthorised

If you use a proper token:

curl http://boris:12345@localhost:9090/

or using curl user:

curl -u "boris:12345" http://localhost:9090/

or using bas64 encoded credentials:

http://localhost:9090/ -H "Authorization: Basic Ym9yaXM6MTIzNDU="

the request will be forwarded to the actial server

JWT based authentication

Implementation is based on this blog post. Some other options are rescibed here. The authorisation is based on the JWT token. It provides a signon method allowing user to get a JWT token based on token based authentication (see above). Once JWT token is obtained by client it can use use it by submitting it as a header jwt-token. The implementation of handler is here. The main defines proxy parameters, and starts the proxy server using handler.

To test it first execute:

curl http://localhost:9090/signon -H "auth-token: 12345"

which returns jwt token, that can be used in the subsequent request

curl http://localhost:9090/hello -H "jwt-token: <token>"

the request will be forwarded to the actial server

Using HTTPS

The same proxy can be used for TLS-terminating of the client's request. For more details reffer to this blog post and this gist. Note that in this case ListenAndServeTLS is used which requires certificate

Supporting GRPC

GRPC support is based on the GRPC proxy. Currently only Token based authorization is implemented, but additional authentication mechanisms, described above can be implemented in a similar fashion, see, for example, here

For local testing of handler you can use handler_test and for proxy - proxy_test. To test the whole thing, start server, and then proxy. With them running, you can use a simple client to exercise everything.