title: What does a JWT cookie need to look like to work with NGINX modules?
body: <p>I have been using NGINX as a reverse proxy and recently decided I needed to add authentication to a route on a website. I realised that there area multiple NGINX modules that could allow me to handle the authentication through NGINX (see links below). So, I build a single-sing-on login page that integrates auth0 to test how this would work.</p>
  
  <p>All modules are similar and allow you to specify an <code>auth_jwt_key</code> (for validation of the JWT) as well as a variable to where the JWT (<code>auth_jwt</code>) is stored. I decided to store the JWT in a cookie.</p>
  
  <p>Unfortunately, I can not get the validation through NGINX to work and keep seeing a <code>401 unauthorized</code> return code.</p>
  
  <p>Here is the part of the flask app, where I am handling the auth0 login and storing the JWT into a cookie:</p>
  
  <pre><code>@app.route('/callback')
      def callback_handling():
      token = auth0.authorize_access_token()
      response = redirect('/dashboard')
      response.set_cookie('lt_jwt', value=token.get('id_token'), max_age=token.get('expires_in'))
      return response
  </code></pre>
  
  <p><strong>Can you see something wrong with this?</strong> The resulting cookie looks something like this (I removed most of it for readability): <code>lt_jwt   eyJ0eX[...]SkRNZyJ9.eyJnaXZ[...]kzNDV9.d3Tzr[...]NzbA   staging-auth0-login.scapp.io    /   9/13/2018, 1:55:45 PM   1.03 KB</code></p>
  
  <p>I can put the cookie value into jwt.io and decode it properly, but my problem is that the mentioned NGINX modules have issues decoding it. </p>
  
  <p>Here is an example NGINX config, where I am setting up the authentication:</p>
  
  <pre><code>location = /dashboard {
      auth_jwt_key "AUTH0_CLIENT_SECRET";
      auth_jwt $cookie_lt_jwt;
  
      root /usr/src/lt/nginx;
      try_files /dashboard.html =404;
  }
  </code></pre>
  
  <p>Basically, I never get to see <code>dashboard.html</code> and always get the <code>401 unauthorized</code>. The NGINX <code>error.log</code> shows that decoding the JWT failed: <code>[warn] 64#64: *23 JWT: failed to parse jwt</code>, which in this case is an error log from the custom nginx module I used:</p>
  
  <pre><code>// Validate the jwt
  if (jwt_decode(&amp;jwt, jwt_data, conf-&gt;jwt_key.data, conf-&gt;jwt_key.len))
  {
    ngx_log_error(NGX_LOG_WARN, r-&gt;connection-&gt;log, 0, "JWT: failed to parse jwt");
    return NGX_HTTP_UNAUTHORIZED;
  }
  </code></pre>
  
  <p>Reference: <a href="https://github.com/maxx-t/nginx-jwt-module/blob/d9a2ece81ca66647f81fc2586b29b348af67f8aa/src/ngx_http_auth_jwt_module.c#L124" rel="nofollow noreferrer">https://github.com/maxx-t/nginx-jwt-module/blob/d9a2ece81ca66647f81fc2586b29b348af67f8aa/src/ngx_http_auth_jwt_module.c#L124</a></p>
  
  <p>Unfortunately, it's not super easy to debug it, but I received a similar response from another custom NGINX module that I also tested: <code>jwt_verify: error on decode: SUCCESS</code>, which is a result of this code segment:</p>
  
  <pre><code>  jwt_t* token;
    int err = jwt_decode(&amp;token, token_data, alcf-&gt;key.data, alcf-&gt;key.len);
    if (err) {
      ngx_log_error(NGX_LOG_ERR, r-&gt;connection-&gt;log, errno,
                    "jwt_verify: error on decode: %s", strerror(errno));
      return ngx_http_auth_jwt_set_realm(r, &amp;alcf-&gt;realm);
    }
  </code></pre>
  
  <p>Reference: <a href="https://github.com/tizpuppi/ngx_http_auth_jwt_module/blob/bf8ae5fd4b8e981b7683990378356181dee93842/ngx_http_auth_jwt_module.c#L247" rel="nofollow noreferrer">https://github.com/tizpuppi/ngx_http_auth_jwt_module/blob/bf8ae5fd4b8e981b7683990378356181dee93842/ngx_http_auth_jwt_module.c#L247</a></p>
  
  <p>So in both cases <code>jwt_decode</code> is called and fails (even though it's error code apparently is <code>SUCCESS</code>).</p>
  
  <p>The reason I am asking here is that I feel I might be doing something conceptually wrong here:</p>
  
  <ol>
  <li>formatting the cookie (I have seen jwt cookies looking like this:
  <code>Bearer eyJ0eX[...]SkRNZyJ9.eyJnaXZ[...]kzNDV9.d3Tzr[...]NzbA</code></li>
  <li>assuming that an auth0 generated token can be used this way</li>
  <li>...?</li>
  </ol>
  
  <p>Please let me know if you have any insight or good working example with NGINX + auth0. I have read this article <a href="https://auth0.com/blog/use-nginx-plus-and-auth0-to-authenticate-api-clients/" rel="nofollow noreferrer">https://auth0.com/blog/use-nginx-plus-and-auth0-to-authenticate-api-clients/</a> by auth0 detailing how a very similar NGINX Pro module could be used, but I don't have access to that commercial module.</p>