Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

js_content + auth_request + proxy_pass = timeout #12

Closed
drsm opened this issue May 7, 2018 · 5 comments
Closed

js_content + auth_request + proxy_pass = timeout #12

drsm opened this issue May 7, 2018 · 5 comments
Labels
answered question

Comments

@drsm
Copy link
Contributor

drsm commented May 7, 2018 

$ cat recaptcha.js 

function recaptcha(req, res) {
  res.return(204);
}
$ cat recaptcha.conf 
js_include conf.d/recaptcha.js;

server {
    listen 2121;
    server_name localhost;

    error_log  /var/log/nginx/recaptcha.error.log debug;
    access_log  /var/log/nginx/recaptcha.access.log main;

    location = /recaptcha {
        js_content recaptcha;
        #return 204;    
    }
}

server {
    listen 2323;
    server_name localhost;

    error_log  /var/log/nginx/recaptcha.error.log debug;
    access_log  /var/log/nginx/recaptcha.access.log main;

    location = /recaptcha {
        proxy_method GET;
        proxy_pass http://localhost:2121;
    }

    location = /test {
        auth_request /recaptcha;
        proxy_pass http://localhost:2424;
    }
}

server {
    listen 2424;
    server_name localhost;

    error_log  /var/log/nginx/recaptcha.error.log debug;
    access_log  /var/log/nginx/recaptcha.access.log main;

    location = /test {
        return 200 '{ "ok": true }';    
    }
}
$ curl -v -X POST http://localhost:2323/test --data-raw '{"login":"login", "password":"password"}' && echo
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 2323 (#0)
> POST /test HTTP/1.1
> Host: localhost:2323
> User-Agent: curl/7.47.0
> Accept: */*
> Content-Length: 40
> Content-Type: application/x-www-form-urlencoded
> 
* upload completely sent off: 40 out of 40 bytes
< HTTP/1.1 500 Internal Server Error
< Server: nginx/1.13.12
< Date: Mon, 07 May 2018 17:37:26 GMT
< Content-Type: text/html
< Content-Length: 194
< Connection: close
< 
<html>
<head><title>500 Internal Server Error</title></head>
<body bgcolor="white">
<center><h1>500 Internal Server Error</h1></center>
<hr><center>nginx/1.13.12</center>
</body>
</html>
* Closing connection 0

$ tail -n 2 /var/log/nginx/recaptcha.error.log 
2018/05/07 20:37:26 [error] 4155#4155: *8 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 127.0.0.1, server: localhost, request: "POST /test HTTP/1.1", subrequest: "/recaptcha", upstream: "http://127.0.0.1:2121/recaptcha", host: "localhost:2323"
2018/05/07 20:37:26 [error] 4155#4155: *8 auth request unexpected status: 504 while sending to client, client: 127.0.0.1, server: localhost, request: "POST /test HTTP/1.1", host: "localhost:2323"
@drsm
Copy link
Contributor Author

drsm commented May 7, 2018

it works with this change

    location = /recaptcha {
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_pass http://localhost:2121;
    }

but what if i need a request body...

@xeioex
Copy link
Contributor

xeioex commented May 7, 2018

Hi, @drsm unfortunately, the timeout issue is not related to njs at all. It is the way auth_request module is written.

Talking about njs in the access phase: We are planning to add njs http access phase handler in the near future (similar to js_access in stream module http://nginx.org/ru/docs/stream/ngx_stream_js_module.html#js_access).

@drsm
Copy link
Contributor Author

drsm commented May 7, 2018 •
edited
Loading

Hi, @xeioex, thank you for the answer! I've just found an explanation in the docs:
https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/

As the request body is discarded for authentication subrequests, you will need to set the proxy_pass_request_body directive to off and also set the Content-Length header to a null string:

I think it is good to note this also here: https://nginx.org/en/docs/http/ngx_http_auth_request_module.html

@drsm drsm closed this as completed May 7, 2018
@xeioex xeioex added the question label May 9, 2018
@xeioex xeioex added the answered label May 9, 2019
@jzebor jzebor mentioned this issue Jun 4, 2019
Closed
@maniLonkar
Copy link

@drsm Can you share the exact conf you used to get the response body with js_content

@drsm
Copy link
Contributor Author

drsm commented Jun 11, 2019

@maniLonkar

Please, create an issue and explain your problem there in details.

This was referenced Mar 1, 2022
Closed
Closed
Closed
@VadimZhestikov VadimZhestikov mentioned this issue Sep 9, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
answered question
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@drsm @xeioex @maniLonkar