sophie/nuke
1
0
Fork 0
Code Packages 1 Activity Actions

docs(subrequest-auth): document required policy changes (#613)

Browse source 
* docs(subrequest-auth): document required policy changes

Signed-off-by: foosinn <foosinn@f2o.io>

* chore: spelling

Signed-off-by: Xe Iaso <me@xeiaso.net>

---------

Signed-off-by: foosinn <foosinn@f2o.io>
Signed-off-by: Xe Iaso <me@xeiaso.net>
Co-authored-by: Xe Iaso <me@xeiaso.net>
This commit is contained in:
foosinn 2025-06-05 22:53:18 +02:00 • committed by GitHub
parent 76fa3e01a5
commit 9f1d791991
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 17 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
.github/actions/spelling/expect.txt vendored
View file

@ -9,6 +9,7 @@ anubistest
Applebot Applebot
archlinux archlinux
badregexes badregexes
bdba
berr berr
bingbot bingbot
bitcoin bitcoin
@ -27,6 +28,7 @@ caninetools
Cardyb Cardyb
celchecker celchecker
CELPHASE CELPHASE
cerr
certresolver certresolver
CGNAT CGNAT
cgr cgr
@ -183,6 +185,7 @@ prebaked
privkey privkey
promauto promauto
promhttp promhttp
proofofwork
pwcmd pwcmd
pwuser pwuser
qualys qualys

14
docs/docs/admin/configuration/subrequest-auth.mdx
View file

@ -10,6 +10,20 @@ Anubis can act in one of two modes:
1. Reverse proxy (the default): Anubis sits in the middle of all traffic and then will reverse proxy it to its destination. This is the moral equivalent of a middleware in your favorite web framework. 1. Reverse proxy (the default): Anubis sits in the middle of all traffic and then will reverse proxy it to its destination. This is the moral equivalent of a middleware in your favorite web framework.
2. Subrequest authentication mode: Anubis listens for requests and if they don't pass muster then they are forwarded to Anubis for challenge processing. This is the equivalent of Anubis being a sidecar service. 2. Subrequest authentication mode: Anubis listens for requests and if they don't pass muster then they are forwarded to Anubis for challenge processing. This is the equivalent of Anubis being a sidecar service.
:::note
Subrequest authentication requires changing the default policy because nginx interprets the default `DENY` status code `200` as successful authentication and allows the request.
```yaml
status_codes:
CHALLENGE: 200
DENY: 403
```
[See policy definitions](../policies.mdx).
:::
## Nginx ## Nginx
Anubis can perform [subrequest authentication](https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/) with the `auth_request` module in Nginx. In order to set this up, keep the following things in mind: Anubis can perform [subrequest authentication](https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-subrequest-authentication/) with the `auth_request` module in Nginx. In order to set this up, keep the following things in mind: