auth htp request module of nginx is not working giving 500 error

Question

I'm trying to config http_auth_request_module but my auth request url is not working but if i pass "return 200" instead of url proxy pass then it works but not in case of proxy_pass based url. what's the procedure and request url pattern which needs to pass for getting status code from URL.

server { server_name xx.xx6.1x5.1x5;


listen 80;

client_max_body_size 4G;

access_log /home/ubuntu/logs/nginx-access.log;
error_log /home/ubuntu/logs/nginx-error.log;

location / {
    auth_request /auth;
    error_page 401 = @error401;

    auth_request_set $user $upstream_http_x_forwarded_user;
    proxy_set_header X-Forwarded-User $user;
    proxy_pass http://1x.2xx.22x.1x4:9200;
}

location @error401 {
    return 302 https://gmail.com;
}

location /auth {
    internal;
    #return 200; ##it's working
    proxy_pass https://google.com; ##it's not working giving error 500
    proxy_pass_request_body  off;

    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

}

Answer 1

This is how it works on my server. The nginX config is

    location ~ ^/attached {
        auth_request /auth-here;
    }
    location /auth-here {
        proxy_pass http://example.com/auth.php;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
    }
    location / {
        try_files $uri $uri/ @rewrites;
    }
    location @rewrites {
        rewrite ^/apple /favicon.ico break;
        rewrite ^ /index.php last;
    }

Then the contents of auth.php

session_start();
// check whether the user is logged in - using whatever mechanism your application is using
if(!$logged_in)
{
    $u = trim($_SERVER['PHP_AUTH_USER']);
    $p = trim($_SERVER['PHP_AUTH_PW']);
    // if no Authorization provided - ask for one
    if($u=='' OR $p=='')
    {
        header('WWW-Authenticate: Basic realm="Your session timed out - login again"');
        header('HTTP/1.0 401 Unauthorized');
        echo 'Bad login - wrong username or password';
        die;
    }
    else
    {
        // try to login using the provided credentials
        if(tryLogin($u,$p))
        {
            // we are now logged in
        }
        else
        {
            // could not login - ask authorization again
            header('WWW-Authenticate: Basic realm="Your session timed out - login again"');
            header('HTTP/1.0 401 Unauthorized');
            echo 'Bad login - wrong username or password';
            die;
        }
    }
}

Basically, if the user is logged in we do nothing. If he/she is not logged in - we ask for credentials (or you could simply return 403)