Repository navigation
[FEATURE] Pass JWT in Authorization header #963
Description
Activity
For context, a few related threads:
- [FEATURE] conditional Authorization header passthrough to upstream service #858 asked for a similar Bearer passthrough to the upstream app and was closed as out of scope.
- fix: stop forwarding client Authorization header to downstream apps #1042 confirmed that tinyauth forwards the client's
Authorizationheader as-is. feat: support x-tinyauth-authorization header for basic authentication #1126 (open) addsX-Tinyauth-Authorizationso tinyauth's Basic credentials and an app's own Bearer token don't compete for the same header.
From the current code (
main@ 8d99068): the OAuth token is only held in the pending-login cache (GetOAuthTokenininternal/service/auth_service.go) and isn't kept after login. The storedSessionhas no token field. So this would need:- Token storage in the session (sqlite + postgres migration).
- Refresh handling, because IdP tokens usually expire long before a tinyauth session does.
- A choice of which token to send. Google's access token is opaque and only its
id_tokenis a JWT, while GitHub provides noid_tokenat all. - A precedence rule with the existing per-app Basic Auth
Authorizationheader insetHeaders.
Would a scoped, opt-in version (per app, OIDC providers only,
id_tokenonly) be something you'd consider, or is this out of scope like #858?Disclosure: the code references above were gathered with AI assistance and checked by me.
Is your feature request related to a problem? Please describe.
I have applications that do their own auth based on JWT that I would like to use tinyauth to get the JWT from the IDP and send to the backend application.
Describe the solution you'd like.
A optional config flag that when enabled passes the JWT from the IDP inside the Authorization HTTP header along to the backend application.
Like what oauth2-proxy does.
Describe alternatives you've considered.
No response
Additional context
No response
Human Written Confirmation