title: Why must we read the request body before doing a subrequest using OpenResty / nginx lua?
body: <p>We are partly delegating nginx access control to a separate service, and we use access_by_lua_file and lua-resty-hawk and subrequests to do the authentication of the request.</p>
  
  <p>The <a href="https://github.com/openresty/lua-nginx-module#ngxlocationcapture" rel="nofollow">docs</a> say:</p>
  
  <blockquote>
    <p>You should always read the request body (by either calling ngx.req.read_body or configuring lua_need_request_body on) before initiating a subrequest.</p>
  </blockquote>
  
  <p>Originally we had missed this detail, things <em>appeared</em> to be working.  I was trying to find more background information on this requirement but came up empty.</p>
  
  <p>It would be nice to authorize the request before reading the body, since we may be able to terminate the connection early and prevent a kind of DoS attack if clients are just trying to upload all sorts of junk and fill our disk.</p>
  
  <p>Why is this restriction in place?</p>