Skip to content

Trusted Reverse Proxy Authentication

Overview

This page explains the function that obtains the user name from an HTTP header added by a trusted reverse proxy and logs in automatically.

Precautions

  1. Use this function only in a configuration where the client cannot forge the header directly (a configuration in which the reverse proxy always overwrites the header).
  2. If you enable it in a public environment without appropriate network restrictions, there is a risk of spoofing.

Setting the Parameter TrustedProxyParameters

Referring to the following, set the parameter TrustedProxyParameters in the configuration file Authentication.json.

Parameter Name Configuration Example Description
Enabled true Specify true to enable the function.
If the environment variable TRUSTED_PROXY_AUTH_ENABLED is set, its value takes precedence.
Header "X-Forwarded-User" Specify the name of the HTTP header that holds the user name.
If the environment variable TRUSTED_PROXY_AUTH_HEADER is set, its value takes precedence.
Configuration example of Authentication.json
{
        : omitted
    "TrustedProxyParameters": {
        "Enabled": true,
        "Header": "X-Forwarded-User"
    }
}

Settings by Environment Variable and Their Precedence

If the following environment variables are set, they take precedence over the values in Authentication.json.

Environment Variable Name Corresponding
Parameter		 Behaviour
TRUSTED_PROXY_AUTH_ENABLED Enabled A value other than an empty string
The function is enabled. It is also enabled by values other than true (for example 1).
TRUSTED_PROXY_AUTH_HEADER Header When not empty
The value of this environment variable is used.

When empty
The value of the parameter Header in Authentication.json is used.

Restriction by Source IP

To target only requests from specific sources for automatic login, always set the parameter ForwardedHeaders.KnownNetworks or ForwardedHeaders.KnownProxies in Security.json. For details, refer to Security.json.

Supported Versions

Supported Version Description
Version 1.5.3.0 and later Function added