[!NOTE] Token Exchange module fork This fork changes the module to perform token exchange to JWT to be used with authorization servers that doesn't support token introspection to JWT, for instance Zitadel. Use the authorization servers token endpoint instead of introspection endpoint in the configuration.
NGINX module that introspects access tokens according to RFC 7662, producing a "phantom token" that can be forwarded to back-end APIs and Web services. Read more about the Phantom Token approach.
This module, when enabled, filters incoming requests, denying access to those which do not have a valid OAuth access token presented in an Authorization header. From this header, the access_token is extracted and introspected using the configured endpoint. The Curity Identity Server replies to this request according to the standard. For an active access token, the body of the Curity Identity Server's response contains the JWT that replaces the access token in the header of the request that is forwarded by NGINX to the back-end. If the token is not valid or absent, no request to the back-end is made and the caller is given a 401, unauthorized, error. This flow is shown in the following diagram:
The initial calls by the app (web or native) are done using OpenID Connect (OIDC). The important part is that the token that is issued is an opaque access token. It is a GUID or UUID or a few handfuls of random bytes; there is no identity-related data in this token. It is a phantom of the actual user data, hence the name -- phantom token. The app presents the token to the NGINX gateway according to the Bearer Token Usage specficiation (i.e., RFC 6750). This standard says that the app should send the phantom token in the Authorization request header.
Once the NGINX server receives the access token, this module will kick in. Using configuration like that below, this module will interrogate the request, find the token, and make a sideways call to the Curity Identity Server. This web service request will be done using the Token Introspection standard (RFC 7662) with an Accept type of application/jwt (as defined in RFC 7519). This will cause the Curity Identity Server to return not JSON but just a JWT. Then, the module will forward the JWT token to the back-end APIs and microservices.
If the module is also configured to cache the results of the call to the Curity Identity Server (which it should be for production cases), the phantom token will be used as a cache key for the corresponding JWT token. This will eliminate the need for subsequent calls to the Curity Identity Server for as long as it tells the NGINX module it may cache the JWT for.
The tl;dr is a very simple API gateway that is blazing fast, highly scalable, and without any bells and whistles to get in the way. All the code is here, so it's easy to change and use with other OAuth servers even!
All the directives in this subsection are required; if any of these are omitted, the module will be disabled.
Syntax:
phantom_tokenon|offDefault:
offContext:
location
Syntax:
phantom_token_client_credentialstringstringDefault:
—Context:
location
The client ID and secret of the OAuth client which will be used for introspection. The first argument to this directive is the client ID and the second is the secret. The maximum total length of the two arguments must be less than 255 characters. Both should be printable ASCII values; non-ASCII values may work but are untested. If this directive is not configured, then the module will be disabled.
Syntax:
phantom_token_introspection_endpointstringDefault:
—Context:
location
The name of the location that proxies requests to the Curity Identity Server. Note that this location needs to be in the same server as the one referring to it using this directive.
Example configuration:
server {
location /api {
...
phantom_token_introspection_endpoint my_good_location_name_for_curity;
}
location my_good_location_name_for_curity {
...
}
}The following directives are optional and do not need to be configured.
Syntax:
phantom_token_realmstringDefault:
apiContext:
location
The name of the protected realm or scope of protection that should be used when a client does not provide an access token.
Example configuration:
location / {
...
phantom_token_realm "myGoodRealm";
} Syntax:
phantom_token_scopesstringDefault:
—Context:
location
The space-separated list of scopes that the server should inform the client are required when it does not provide an access token.
Example configuration:
location / {
...
phantom_token_scopes "scope_a scope_b scope_c";
}Syntax:
phantom_token_scopestringDefault:
—Context:
location
An array of scopes that the server should inform the client are required when it does not provide an access token. If phantom_token_scopes is also configured, that value will supersede these.
Example configuration:
location / {
...
phantom_token_scope "scope_a";
phantom_token_scope "scope_b";
phantom_token_scope "scope_c";
}If the module is downloaded from GitHub or compiled as a shared library (the default) and not explicitly compiled into NGINX, it will need to be loaded using the load_module directive. This needs to be done in the main part of the NGINX configuration:
load_module modules/ngx_curity_http_phantom_token_module.so;The file can be an absolute or relative path. If it is not absolute, it should be relative to the NGINX root directory.
The following is a simple configuration that might be used in demo or development environments where the NGINX reverse proxy is on the same host as the Curity Identity Server:
server {
location /api {
proxy_pass https://example.com/api;
phantom_token on;
phantom_token_client_credential "client_id" "client_secret";
phantom_token_introspection_endpoint curity;
}
location curity {
proxy_pass "https://curity.example.com/oauth/v2/introspection";
}
}The following is a more complex configuration where the NGINX reverse proxy is on a separate host to the Curity Identity Server:
server {
server_name server1.example.com;n
location /api {
proxy_pass https://example.com/api;
phantom_token on;
phantom_token_client_credential "client_id" "client_secret";
phantom_token_introspection_endpoint curity;
phantom_token_realm "myGoodAPI";
phantom_token_scopes "scope_a scope_b scope_c";
}
location curity {
proxy_pass "https://server2.example.com:8443/oauth/v2/introspection";
}
}
server {
listen 8443;
server_name server2.example.com;
location / {
proxy_pass "https://curity.example.com";
}
}This module takes advantage of NGINX built-in proxy_cache directive. In order to be able to cache the requests made to the introspection endpoint, except of the proxy_cache_path in http context and proxy_cache in location context, you have to add the following 3 directives in the location context of the introspection endpoint.
proxy_cache_methods POST;POST requests are not cached by default.proxy_cache_key $request_body;The key of the cache is related to the access_token sent in the original request. Different requests using the same access_token reach the same cache.proxy_ignore_headers Set-Cookie;NGINX will not cache the response ifSet-Cookieheader is not ignored.
http {
proxy_cache_path /path/to/cache/cache levels=1:2 keys_zone=my_cache:10m max_size=10g
inactive=60m use_temp_path=off;
server {
server_name server1.example.com;
location /api {
proxy_pass https://example.com/api;
phantom_token on;
phantom_token_client_credential "client_id" "client_secret";
phantom_token_introspection_endpoint curity;
phantom_token_scopes "scope_a scope_b scope_c";
phantom_token_realm "myGoodAPI";
}
location curity {
proxy_pass "https://server2.example.com:8443/oauth/v2/introspection";
proxy_cache_methods POST;
proxy_cache my_cache;
proxy_cache_key $request_body;
proxy_ignore_headers Set-Cookie;
}
}
server {
listen 8443;
server_name server2.example.com;
location / {
proxy_pass "https://curity.example.com";
}
}
} This module is compatible with Curity Identity Server versions >= 2.2. It has been tested with NGINX 1.13.7 (NGINX Plus Release 14) and NGINX 1.13.10 (NGINX Plus Release 15). It is likely to work with other, newish versions of NGINX, but only these have been tested, pre-built and verified.
Pre-built binaries of this module are provided for the following versions of NGINX on the corresponding operating system distributions:
| NGINX 1.25.1 / NGINX Plus R30 | NGINX 1.23.4 / NGINX Plus R29 | NGINX 1.23.2 / NGINX Plus R28 | NGINX 1.21.6 / NGINX Plus R27 | NGINX 1.21.5 / NGINX Plus R26 | |
|---|---|---|---|---|---|
| Amazon Linux 2 | ⇓ | ⇓ | ⇓ | ⇓ | ⇓ |
| Amazon Linux 2023 | ⇓ | ⇓ | ⇓ | ⇓ | ⇓ |
| CentOS 7.0+ | ⇓ | ⇓ | ⇓ | ⇓ | ⇓ |
| CentOS Stream 9.0+ | ⇓ | ⇓ | ⇓ | ⇓ | ⇓ |
| Debian 10.0 (Buster) | ⇓ | ⇓ | ⇓ | ⇓ | ⇓ |
| Debian 11.0 (Bullseye) | ⇓ | ⇓ | ⇓ | ⇓ | ⇓ |
| Debian 12.0 (Bookworm) | ⇓ | ⇓ | ⇓ | ⇓ | ⇓ |
| Alpine | ⇓ | ⇓ | ⇓ | ⇓ | ⇓ |
| Ubuntu 18.04 LTS (Bionic Beaver) | ⇓ | ⇓ | ⇓ | ⇓ | ⇓ |
| Ubuntu 20.04 LTS (Focal Fossa) | ⇓ | ⇓ | ⇓ | ⇓ | ⇓ |
| Ubuntu 22.04 LTS (Jammy Jellyfish) | ⇓ | ⇓ | ⇓ | ⇓ | ⇓ |
This module is fit for production usage.
If you wish to build this module from source, in order to run against other NGINX versions, or to change the module's logic, see the Development Wiki for instructions.
For more information about the Curity Identity Server, its capabilities, and how to use it to issue phantom tokens for microservices, visit curity.io. For background information on using the Curity Identity Server to secure API access, see our API security resources.
This software is copyright (C) 2022 Curity AB. It is open source software that is licensed under the Apache v. 2. For commercial support of this module, please contact Curity sales.