mirror of
https://github.com/blakeblackshear/frigate.git
synced 2025-09-26 11:31:28 +08:00
1133202cbd
* reload the window on 401 * backend apis for auth * add login page * re-enable web linter * fix login page routing * bypass csrf for internal auth endpoint * disable healthcheck in devcontainer target * include login page in vite build * redirect to login page on 401 * implement config for users and settings * implement JWT actual secret * add brute force protection on login * add support for redirecting from auth failures on api calls * return location for redirect * default cookie name should pass regex test * set hash iterations to current OWASP recommendation * move users to database instead of config * config option to reset admin password on startup * user management UI * check for deleted user on refresh * validate username and fixes * remove password constraint * cleanup * fix user check on refresh * web fixes * implement auth via new external port * use x-forwarded-for to rate limit login attempts by ip * implement logout and profile * fixes * lint fixes * add support for user passthru from upstream proxies * add support for specifying a logout url * add documentation * Update docs/docs/configuration/authentication.md Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com> * Update docs/docs/configuration/authentication.md Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com> --------- Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
43 lines
1.4 KiB
Plaintext
43 lines
1.4 KiB
Plaintext
set $upstream_auth http://127.0.0.1:5001/auth;
|
|
|
|
## Virtual endpoint created by nginx to forward auth requests.
|
|
location /auth {
|
|
## Essential Proxy Configuration
|
|
internal;
|
|
proxy_pass $upstream_auth;
|
|
|
|
## Headers
|
|
|
|
# First strip out all the request headers
|
|
# Note: This is important to ensure that upgrade requests for secure
|
|
# websockets dont cause the backend to fail
|
|
proxy_pass_request_headers off;
|
|
# Pass info about the request
|
|
proxy_set_header X-Original-Method $request_method;
|
|
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
|
|
proxy_set_header X-Server-Port $server_port;
|
|
proxy_set_header Content-Length "";
|
|
# Pass along auth related info
|
|
proxy_set_header Authorization $http_authorization;
|
|
proxy_set_header Cookie $http_cookie;
|
|
proxy_set_header X-CSRF-TOKEN "1";
|
|
|
|
# include headers from common auth proxies
|
|
include proxy_trusted_headers.conf;
|
|
|
|
## Basic Proxy Configuration
|
|
proxy_pass_request_body off;
|
|
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503; # Timeout if the real server is dead
|
|
proxy_redirect http:// $scheme://;
|
|
proxy_http_version 1.1;
|
|
proxy_cache_bypass $cookie_session;
|
|
proxy_no_cache $cookie_session;
|
|
proxy_buffers 4 32k;
|
|
client_body_buffer_size 128k;
|
|
|
|
## Advanced Proxy Configuration
|
|
send_timeout 5m;
|
|
proxy_read_timeout 240;
|
|
proxy_send_timeout 240;
|
|
proxy_connect_timeout 240;
|
|
} |