auth_request and multiple sequential subrequests

[Pavel Kolla]

Thanks to Piotr & Maxim for helping with suppling proper headers along with
auth_requst!

Now I got a question about possibility to use auth_request in internal
subrequest similar to this:

location /t/
{
set $t 0;
auth_request /t1;
echo "base $t";
}

location /t1
{
# internal
auth_request /t2;
set $t 1;
echo "t1 $t";
}

location /t2
{
# internal
set $t 2;
return 403;
}

That doesn't really function as i expect and result in:

$ curl host/t/
base 1
$ curl -I host/t1
HTTP/1.1 403 Forbidden

(for sake of experiment I actually created the dirs so nginx doesn;t complain
with 404s on second request, but originally i had them as internal)

The main idea is to have 2 sequential checks where only success in both leads
to handling /t/, but each check can return different errors depending on
internal processing.

At this stage i'm not even sure if it is possible to use auth_request directive
in a subrequest, so i seek for wisdom here...

[agentzh]

Post by Pavel Kolla
location /t1
{
#   internal
   auth_request    /t2;
   set $t 1;
   echo "t1 $t";
}

Your /t1 does not run auth_request when it is used in a subrequest
just because nginx access phase handlers will be skipped altogether
for subrequests (as opposed to rewrite and content phase handlers).
This is a common pitfall but can also be a useful feature for minor
optimizations.

You put "set $t 1" after "auth_request" here is confusing. Because
"set" runs at the rewrite phase and will always run before any access
phase directives like "auth_request" even if you put "set" after it.

BTW, you can utilize the rewrite_by_lua directive to do this kind of
generalized access control like this:

rewrite_by_lua '
local res = ngx.location.capture("/some_location")
if res.status == ngx.HTTP_FORBIDDEN then
return res.status
end

if res.status ~= ngx.HTTP_OK then
return ngx.HTTP_INTERNAL_SERVER_ERROR
end
';

This is the first-order approximation of a rewrite-phase auth_request
using ngx_lua and rewrite phase handlers also run in subrequests :)

See http://github.com/chaoslawful/lua-nginx-module for details.

Post by Pavel Kolla
At this stage i'm not even sure if it is possible to use auth_request directive
in a subrequest, so i seek for wisdom here...

Surely not. See the reason I've given above :)

Cheers,
-agentzh