[PR #836] [MERGED] feat: allow authentication using proxy request header #811

New issue

Closed

opened 2026-02-25 23:35:33 +03:00 by kerem · 0 comments

kerem commented

2026-02-25 23:35:33 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/go-shiori/shiori/pull/836
Author: @PterX
Created: 2/5/2024
Status: ✅ Merged
Merged: 2/13/2024
Merged by: @fmartingr

Base: master ← Head: master

📄 Description

This submission implements the working method of oauth header authentication, which needs to be combined with the reverse proxy service and oauth service to achieve password-free authentication login.
For example: The following is explained by combining the configuration of nginx and authelia
Refer to the auth documentation page https://www.authelia.com/integration/proxies/nginx/

We can use the following configurations
/config/nginx/snippets/proxy.conf
/config/nginx/snippets/authelia-location.conf
/config/nginx/snippets/authelia-authrequest.conf

nginx configuration is as follows

server{
    listen 80;
    server_name shiori.example.com;

    include /config/nginx/snippets/authelia-location.conf;

    location / {
        proxy_pass http://10.0.0.1:8080; // pass to shiori
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        include /config/nginx/snippets/authelia-authrequest.conf;
        include /config/nginx/snippets/proxy.conf;
    }
}

Way of working
step 1
Client request -> nginx proxy(auth request, not login) -> authelia ( redirect to auth page)

step 2
Client request -> nginx proxy(auth request, it was login with oauth) -> authelia (verify api) -> shiori (get auth user header, like user name) -> shiori (getTokenFromAuthHeader: trust && query account by user name) -> shiori (generate token and session-id,save to cookie)

step 2
Client request(with token,session-id) -> nginx proxy(also auth request,ignore) -> shiori (old work path, getTokenFromCookie, and other check ...) -> shiori (user verify ok) -> shiori ( business code)

Closes #594

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-shiori/shiori/pull/836 **Author:** [@PterX](https://github.com/PterX) **Created:** 2/5/2024 **Status:** ✅ Merged **Merged:** 2/13/2024 **Merged by:** [@fmartingr](https://github.com/fmartingr) **Base:** `master` ← **Head:** `master` --- ### 📄 Description This submission implements the working method of oauth header authentication, which needs to be combined with the reverse proxy service and oauth service to achieve password-free authentication login. For example: The following is explained by combining the configuration of nginx and authelia Refer to the auth documentation page https://www.authelia.com/integration/proxies/nginx/ We can use the following configurations /config/nginx/snippets/proxy.conf /config/nginx/snippets/authelia-location.conf /config/nginx/snippets/authelia-authrequest.conf nginx configuration is as follows ``` server{ listen 80; server_name shiori.example.com; include /config/nginx/snippets/authelia-location.conf; location / { proxy_pass http://10.0.0.1:8080; // pass to shiori proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; include /config/nginx/snippets/authelia-authrequest.conf; include /config/nginx/snippets/proxy.conf; } } ``` Way of working step 1 Client request -> nginx proxy(auth request, not login) -> authelia ( redirect to auth page) step 2 Client request -> nginx proxy(auth request, it was login with oauth) -> authelia (verify api) -> shiori (get auth user header, like user name) -> shiori (getTokenFromAuthHeader: trust && query account by user name) -> shiori (generate token and session-id,save to cookie) step 2 Client request(with token,session-id) -> nginx proxy(also auth request,ignore) -> shiori (old work path, getTokenFromCookie, and other check ...) -> shiori (user verify ok) -> shiori ( business code) Closes #594 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>