Read the article to know more about add_header authorization on NGINX. Bobcares, as a part of our Server Management Service offers solutions to every query that comes our way.

The add_header Authorization on NGINX

The directive add_header Authorization is used with caution because it directly interacts with authorization data, which can be sensitive. While using add_header Authorization to directly set the header in Nginx responses is not best due to security issues. Let’s see the details in the following section:

1. We must keep the authorization token secure on the client side. We can do this using browser storage methods or by storing it within the client program itself.

2. When the client program wishes to access a server resource that needs approval, it adds the saved token to the request’s Authorization header.

3. Nginx will then gets the request that includes the Authorization header and the client’s token.

4. Nginx has two main methods to handle authorization:

i. Basic Auth Module: If we use Nginx’s built-in Basic Auth module, it will normally check the Authorization header for a valid username and password combination. This method necessitates prior setting of allowed users and passwords in a file.

ii. Proxy to Backend Server with Token Validation: Nginx may operate as a reverse proxy, sending the request to a backend server that handles security. Nginx would retrieve the token from the Authorization header and forward it to the backend server. The backend server would then use its own logic to verify the token and give access if it is valid.

5. Depending on the selected method:

i. Basic Auth: If the login details provided in the Authorization header are correct, Nginx grants access and delivers the requested resource to the client. Otherwise, it returns an unauthorized answer (often a 401 status code).

ii. Proxy with Backend Validation: The backend server decides whether the token is genuine and returns an acceptable answer to Nginx. Nginx then sends the response (success or failure) to the client.

[Searching solution for a different question? We’re happy to help.]

Conclusion

This article offers an insight to the steps from our Tech team to add_header authorization on NGINX.