Skip to content

Conversation

w453y
Copy link

@w453y w453y commented Aug 16, 2025

The original auth_jwt_enabled directive only supported static boolean values (on/off), which limited its flexibility for dynamic authentication control. This prevented users from implementing conditional JWT authentication based on runtime conditions such as client IP addresses, request headers, or other nginx variables.

This PR enhances the auth_jwt_enabled directive to support nginx runtime variables, enabling dynamic control of JWT authentication based on request context. This allows for sophisticated access control scenarios such as IP-based whitelisting, conditional authentication based on request headers, or integration with nginx's map and geo modules.

Use Case Example

The primary motivation is to enable VPN subnet whitelisting while maintaining JWT authentication for external traffic:

http {
    geo $jwt_enabled {
        default on;
        10.10.10.0/20 off;  # Disable JWT for VPN subnet
    }

    server {
        location / {
            auth_jwt_enabled $jwt_enabled;  # Now supports variables!
            # ... other JWT directives
        }
    }
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant