Missing Authorization header with ForwardAuth in Traefik

Question

I have following traefik setup:

• mybackend - golang backend
• myauth - dedicated auth backend validating jwt token.

all run with traefik.

I want all requests first pass through myauth backend to validate jwt token / rate limit users before reaching mybackend.

When using this configuration myauth doesn't receive Authorization header containing authorization jwt token.

When I don't use forwardauth middleware Authorization header is there.

Here is the traefik configuration file I have:

version: '3'

services:
  reverse-proxy:
    image: traefik:v2.0
    restart: always
    command:
      - "--api=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.http.address=:80"
      - "--entrypoints.https.address=:443"
      - "--certificatesresolvers.mydnschallenge.acme.dnschallenge=true"
      - "--certificatesresolvers.mydnschallenge.acme.dnschallenge.provider=digitalocean"
      - "--certificatesresolvers.mydnschallenge.acme.email=support@mydomain.com"
      - "--certificatesresolvers.mydnschallenge.acme.storage=/acme.json"
    environment:
      - DO_AUTH_TOKEN=${DO_AUTH_TOKEN}
    ports:
      - "80:80"
      - "443:443"
      - "6969:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ../acme/acme.json:/acme.json

  mybackend:
    image: mybackend
    restart: always
    depends_on:
      - mongo
    labels:
      - "traefik.enable=true"
      # creates new middleware called redirect-to-https
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # creates new router called redirect-https
      - "traefik.http.routers.redirect-https.rule=Host(`api.mydomain.com`)"
      - "traefik.http.routers.redirect-https.entryPoints=http"
      # applies middleware to router
      - "traefik.http.routers.redirect-https.middlewares=redirect-to-https"
      # creates new router called api_tls
      - "traefik.http.routers.api.entryPoints=https"
      - "traefik.http.routers.api.tls.certresolver=mydnschallenge"
      - "traefik.http.routers.api.rule=Host(`api.mydomain.com`)"
      - "traefik.http.services.api.loadbalancer.server.port=8080"
      - "traefik.http.routers.api.middlewares=ratelimitme"
      - "traefik.http.middlewares.ratelimitme.forwardauth.address=http://myauth:8080"
      - "traefik.http.middlewares.ratelimitme.forwardauth.trustforwardheader=true"
      - "traefik.http.middlewares.ratelimitme.forwardauth.authresponseheaders=X-Forwarded-User"


  myauth:
    image: myauth
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.rate_limiting.entrypoints=http"
        - "traefik.http.services.rate_limiting.loadbalancer.server.port=8080"

I tried setting new middleware to set custom headers like this:

        - "traefik.http.middlewares.frontend1.headers.customresponseheaders.Access-Control-Allow-Methods=POST, GET, PUT, OPTIONS, DELETE"
        - "traefik.http.middlewares.frontend1.headers.customresponseheaders.Access-Control-Allow-Origin=*"
        - "traefik.http.middlewares.frontend1.headers.customresponseheaders.Access-Control-Allow-Headers=x-requested-with, Content-Type,Authorization"

but it didn't help.

Thanks for any tips / advices.

Answer 1

Add "Authorization" to the authRequestHeader. For example (using kubernetes):

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: api-auth
  namespace: kube-system
spec:
  forwardAuth:
    address: http://api-auth.default.svc/auth/v1/validate
    authRequestHeaders:
      - "Authorization"
    authResponseHeaders:
      - "X-Auth-ID"
---