Please use this template for troubleshooting questions.
My issue:
I have a service which accepts file uploads up to 25GB. Uploads work as expected with one exception. We use the auth_request module which returns 200 if a token in the request is still valid and 401 otherwise. An error_page location receives the request that got the 401 auth response and that tries to use a refresh token if its present and returns 401 if not. The problem I’m having is that the entire file uploads even though the auth_request endpoint knows with just the headers that the request is not authenticated and to return the 401 status.
I’m hoping someone can identify a mistake in my configuration that would explain why the entire request body uploads regardless of the authentication status of the request.
How I encountered the problem:
If i make a request with a deliberately expired token I notice that the entire file uploads to nginx before the 401 response is returned.
Solutions I’ve tried:
Version of NGINX or NGINX adjacent software (e.g. NGINX Gateway Fabric):
I run the official docker container tag nginx:1.28.0-bookworm in kubernetes.
Deployment environment:
kubernetes and AWS
Minimal NGINX config to reproduce your issue (preferably running on https://tech-playground.com/playgrounds/nginx for ease of debugging, and if not as a code block): (Tip → Run nginx -T to print your entire NGINX config to your terminal.)
These are the most relevant parts of my nginx.conf.
location = /auth {
internal;
client_max_body_size 0;
access_log off;
set $gateway_service_uri http://localhost:8080;
proxy_pass $gateway_service_uri;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_set_header X-Original-URI https://$http_host$request_uri;
proxy_set_header X-Original-Method $request_method;
}
location @unauthorized {
internal;
client_max_body_size 0;
access_log off;
set $gateway_service_uri http://localhost:8080;
proxy_pass $gateway_service_uri/auth/unauthorized;
include proxy-host-header.conf;
include forwarded-request-headers.conf;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
proxy_set_header X-Original-URI https://$http_host$request_uri;
proxy_set_header X-Original-Method $request_method;
}
location = /api/v1/fs/upload {
client_max_body_size 25g;
proxy_read_timeout 1200s;
proxy_send_timeout 1200s;
proxy_request_buffering off;
auth_request /auth;
error_page 401 = @unauthorized;
set $service_uri http://filestore-service.default.svc.cluster.local:8080;
proxy_pass $service_uri;
}
NGINX access/error log: (Tip → You can usually find the logs in the /var/log/nginx directory.)