title: NGINX - lua-resty-openidc - Cannot access POST api url
body: <p>Using Openresty NGINX with lua-resty-openidc configured.</p>
  
  <p><strong>api.conf</strong></p>
  
  <pre><code>location /api/postsomething {
      limit_except POST {
          deny all;
      }
      error_page 403 = @405; # Convert response from '403 (Forbidden)' to '405 (Method Not Allowed)'
      set $upstream api_dev;
      rewrite ^ /_apipost last;
  }
  
  location = /_apipost {
      internal;
      set $api_name "someapi";
      access_by_lua_file /etc/nginx/oauth_authenticate.lua;
      proxy_pass https://$upstream$request_uri;
  }
  </code></pre>
  
  <p><strong>oauth_authenticate.lua</strong></p>
  
  <pre><code>local opts = {
          redirect_uri="https://&lt;ipd&gt;/oauth_callback",
          discovery="https://&lt;idp.ip&gt;/.well-known/openid-configuration",
          client_id="client_id_test",
          client_secret="",
          scope="openid",
          ssl_verify="no"
  }
  local res, err =require("resty.openidc").authenticate(opts)
  
  if err then
          ngx.status = 500
          ngx.say(err)
          ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
  end
  
  local jwt = require "resty.jwt"
  local jwt_obj = jwt:load_jwt(res.access_token)
  
  
  -- Parse the access token that was used above and print it to the logs
  local cjson = require "cjson"
  ngx.log(ngx.DEBUG, "Here is the access token:\n " .. cjson.encode(jwt_obj.payload))
  
  
  -- set headers with user info: this will overwrite any existing headers
  -- but also scrub(!) them in case no value is provided in the token
  ngx.req.set_header("X-USER", res.id_token.sub)
  </code></pre>
  
  <p>Now calling my back end API in postman results in below url,</p>
  
  <pre><code>POST &gt; https://nginx_ip/api/postsomething
  </code></pre>
  
  <p>Result:</p>
  
  <pre><code>&lt;!-- template name: form.autopost.template.html --&gt;
  
  
  &lt;html&gt;
  
  &lt;head&gt;
      &lt;title&gt;Submit Form&lt;/title&gt;
  &lt;/head&gt;
  
  &lt;body onload="javascript:document.forms[0].submit()"&gt;
      &lt;noscript&gt;
          &lt;p&gt;
              &lt;strong&gt;Note:&lt;/strong&gt; Since your browser does not support JavaScript, you must press the Resume button once
              to proceed.
          &lt;/p&gt;
      &lt;/noscript&gt;
      &lt;form method="post" action="https://&lt;idp_ip&gt;/idp/SSO.saml2"&gt;
          &lt;input type="hidden" name="SAMLRequest" value="ddfdfdfdf3Q+"/&gt;
          &lt;input type="hidden" name="RelayState" value="fdfergerger"/&gt;
          &lt;noscript&gt;&lt;input type="submit" value="Resume"/&gt;&lt;/noscript&gt;
      &lt;/form&gt;
  &lt;/body&gt;
  
  &lt;/html&gt;
  </code></pre>
  
  <p>How do i consume an API (POST calls) which is really protected by the OIDC module lua. if i fire the same request in browser it ask's me for the user authentication and the Browser results is this,</p>
  
  <pre><code>405 (Method Not Allowed)
  </code></pre>
  
  <p>Same for if i create a HTML with form POST to an <a href="https://nginx_ip/api/postsomething" rel="nofollow noreferrer">https://nginx_ip/api/postsomething</a> then the result is 405. why? please help .</p>