1

I have a simple proxy which requires an auth_request subrequest for authentication. Authenticated users are then proxied to an s3 url to download a file.

What I am seeing however is it appears the auth subrequest fires more than once per user visit to the proxy url.

I am not sure why this is, one theory I have is that the s3 download is large and requires multiple packets to download, each packet requiring an individual auth subrequest? But this doesn't sound right, I was under the assumption that a single auth subrequest applied for the lifetime of the session.

I know the auth subrequest is firing more than once because in the subrequest code I added logging features which show duplicate entries per a single request.

Does anyone have more information on this?

Below is my nginx config (this occurs with and without the auth_request_set directive in place)

location ~* ^/(assets/.*) {
    auth_request /auth-proxy; 

    resolver 8.8.8.8;

    proxy_pass_request_headers off;
    proxy_pass_request_body off;
    proxy_redirect off;

    auth_request_set $token $upstream_http_token;

    client_max_body_size 5120M;

    proxy_pass https://bucket-name.s3.amazonaws.com/$1?$token;
}

1 Answer 1

1

The issue was not that multiple subrequests were being issues per a single request but that the S3 server being proxied to was responding with 206 Partial Content responses causing the client to issue subsequent requests to grab the rest of the content (which correctly needs to be reauithenticated via a new subrequest).

This was not identified sooner because Firebug was condensing the 206 partial content chain into a single 200 in the network logs, so I was not immediately aware that this was going on behind the scenes until I noticed that S3 will not issue 206 responses when the user agent is wget!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .