As BasicAuth, JWT middleware grants also access to route to authorized users only.
It implements client authorization based on the result of a request using JSON Web Tokens.
The JWT middleware restricts access to routes, similar to BasicAuth, by authorizing users based on JSON Web Tokens (JWTs).
If the request returns a 200 response code, access is allowed.
If it returns 401 or 403, the access is denied with the corresponding error code. Any other response code returned by the request is considered an error.
---
It depends on an authentication service on the backend.
#### How It Works
It works as `ngx_http_auth_request_module` on Nginx
```conf
location /private/ {
auth_request /auth;
...
}
1.**Authorization Logic**
The middleware determines access based on the HTTP response from an authentication service:
- **200 (OK)**: Access is granted.
- **401 (Unauthorized)** or **403 (Forbidden)**: Access is denied with the corresponding error code.
- **Other Response Codes**: Treated as errors.
location = /auth {
proxy_pass ...
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_set_header X-Original-URI $request_uri;
}
2.**Backend Dependency**
The middleware relies on a backend authentication service to validate requests.
3.**Nginx Inspiration**
Its behavior is comparable to `ngx_http_auth_request_module` in Nginx.
Here's an example Nginx configuration:
```
location /private/ {
auth_request /auth;
...
}
location = /auth {
proxy_pass ...;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_set_header X-Original-URI $request_uri;
}
```
You can also get headers from the authentication request result and inject them into the next request header or params.
### Header and Parameter Injection
In case you want to get headers from the authentication service and inject them into the next request headers.
The middleware supports extracting headers from the authentication response and injecting them into the next request’s headers or parameters.
Set the request variable to the given value after the authorization request completes.
Key is authentication request response header Key. Value is the next Request header Key.
1.**Injecting Headers**
Add headers to the next request after a successful authorization:
```yaml
headers:
## Key Authentication request header key and value is next request header key
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.