{"id":31628109,"url":"https://github.com/jirutka/nginx-oidc-njs","last_synced_at":"2026-04-20T19:31:43.912Z","repository":{"id":173977717,"uuid":"651543612","full_name":"jirutka/nginx-oidc-njs","owner":"jirutka","description":"OpenID Connect and OAuth 2.0 module for NGINX written in njs.","archived":false,"fork":false,"pushed_at":"2024-03-07T15:49:19.000Z","size":392,"stargazers_count":10,"open_issues_count":3,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-10-06T20:32:41.636Z","etag":null,"topics":["nginx","njs","oidc-proxy","oidc-resource-server","openid-connect"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jirutka.png","metadata":{"files":{"readme":"README.adoc","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":["jirutka"]}},"created_at":"2023-06-09T13:25:27.000Z","updated_at":"2025-09-06T13:31:47.000Z","dependencies_parsed_at":"2025-10-06T20:32:10.953Z","dependency_job_id":null,"html_url":"https://github.com/jirutka/nginx-oidc-njs","commit_stats":null,"previous_names":["jirutka/nginx-njs-oidc","jirutka/nginx-oidc-njs"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/jirutka/nginx-oidc-njs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jirutka%2Fnginx-oidc-njs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jirutka%2Fnginx-oidc-njs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jirutka%2Fnginx-oidc-njs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jirutka%2Fnginx-oidc-njs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jirutka","download_url":"https://codeload.github.com/jirutka/nginx-oidc-njs/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jirutka%2Fnginx-oidc-njs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32062283,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-20T11:35:06.609Z","status":"ssl_error","status_checked_at":"2026-04-20T11:34:48.899Z","response_time":94,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["nginx","njs","oidc-proxy","oidc-resource-server","openid-connect"],"created_at":"2025-10-06T20:18:09.984Z","updated_at":"2026-04-20T19:31:43.890Z","avatar_url":"https://github.com/jirutka.png","language":"TypeScript","funding_links":["https://github.com/sponsors/jirutka"],"categories":[],"sub_categories":[],"readme":"= NGINX OpenID Connect\n:proj-name: nginx-oidc-njs\n:gh-name: jirutka/{proj-name}\n:version: 0.1.1\n:ngx-docs-url: https://nginx.org/en/docs/http\n:ngx-http-core-url: {ngx-docs-url}/ngx_http_core_module.html\n\nifdef::env-github[]\nimage:https://github.com/{gh-name}/workflows/CI/badge.svg[Binaries Workflow, link=https://github.com/{gh-name}/actions?query=workflow%3A%22CI%22]\nendif::env-github[]\n\nOpenID Connect and OAuth 2.0 module for NGINX written in https://nginx.org/en/docs/njs/[njs] (NGINX JavaScript).\n\n\n== Installation\n\n=== Requirements\n\n.*Runtime:*\n* http://nginx.org[nginx] with:\n** http://nginx.org/en/docs/http/ngx_http_js_module.html[ngx_http_js_module] ≥ 0.7.0\n** https://github.com/kjdev/nginx-keyval[ngx_http_keyval_module] ≥ 0.1.0\n** https://github.com/kjdev/nginx-auth-jwt[ngx_http_auth_jwt_module] ≥ 0.2.1\n\n.*Build:*\n* https://nodejs.org[Node.js] 14.15+\n* https://docs.npmjs.com/cli/commands/npm[npm] (distributed with Node.js)\n* npm packages specified in link:package.json[] (will be installed using npm)\n\n\n=== From release tarball\n\n. Download and verify the latest release tarball:\n+\n[source, sh, subs=\"+attributes\"]\ncurl -sSLO https://github.com/{gh-name}/releases/download/v{version}/{proj-name}-{version}.tar.gz\ncurl -sSL https://github.com/{gh-name}/releases/download/v{version}/{proj-name}-{version}.tar.gz.sha256 | sha256sum -c\n\n. Install files somewhere, e.g. _/usr/local/share/{proj-name}_:\n+\n[source, sh, subs=\"+attributes\"]\nmkdir -p /usr/local/share/{proj-name}\ncp -r {proj-name}-{version}/* /usr/local/share/{proj-name}/\n\n\n=== From source\n\n. Install system dependencies specified in \u003c\u003cRequirements, build requirements\u003e\u003e.\n\n. Clone this repository and jump in:\n+\n[source, sh, subs=\"+attributes\"]\ngit clone git@github.com:{gh-name}.git\ncd {proj-name}\n\n. Build the project:\n+\n[source, sh]\nmake build\n\n. Install files (you may need to run this with sudo):\n+\n[source, sh]\nmake install\n+\nYou may use the `DESTDIR` and `PREFIX` variables to specify the destination.\n\n\n== Configuration\n\n.Example of nginx.conf:\n[source, nginx]\n----\nhttp {\n  # Configure name servers used to resolve domain names.\n  resolver 193.17.47.1 185.43.135.1 [2001:148f:ffff::1] [2001:148f:fffe::1];\n\n  js_import oidc from /path/to/nginx-oidc-njs/nginx-oidc.njs;\n  include /path/to/nginx-oidc-njs/conf/http.conf;\n\n  # Define cache zone for requested and inspected tokens.\n  proxy_cache_path cache/oidc_tokens\n    keys_zone=oidc_tokens:1m\n    levels=2\n    use_temp_path=off\n    inactive=1h\n    max_size=4m;\n\n  keyval_zone_redis zone=oidc_id_tokens ttl=300;\n  keyval_zone_redis zone=oidc_access_tokens ttl=300;\n  keyval_zone_redis zone=oidc_refresh_tokens ttl=604800;\n  keyval_zone_redis zone=oidc_auth_states ttl=60;\n\n  server {\n    listen 443 ssl http2;\n    server_name client.example.org;\n\n    ...\n\n    include /path/to/nginx-oidc-njs/conf/server.conf;\n\n    # This must be large enough to fit a JWT token.\n    subrequest_output_buffer_size 32k;\n\n    set $oidc_issuer \"https://openid.example.org\";\n    set $oidc_authorization_endpoint \"https://openid.example.org/authorize\";\n    set $oidc_token_endpoint \"https://openid.example.org/token\";\n    set $oidc_end_session_endpoint \"https://openid.example.org/logout\";\n    set $oidc_jwks_file \"/path/to/jwks.json\";\n\n    set $oidc_client_id \"oidc-njs\";\n    set $oidc_client_secret \"top-secret\";\n    set $oidc_scope \"openid profile\";\n\n    # This must match the keys_zone name defined above in the http context.\n    set $oidc_cache_zone_tokens \"oidc_tokens\";\n\n    location /api/ {\n      include /path/to/nginx-oidc-njs/conf/auth-proxy.conf;\n\n      proxy_pass \"https://rp.example.org\";\n    }\n\n    location / {\n      set $oidc_access \"flynnkev USER ADMIN\";\n\n      include /path/to/nginx-oidc-njs/conf/auth-access.conf;\n    }\n  }\n}\n----\n\n\n=== Snippets\n\nTo simplify integration into your NGINX configuration, the link:conf/[] directory contains a number of configuration snippets with predefined directives which are necessary for this module to work.\nThese snippets should be included in the NGINX configuration using the link:{ngx-http-core-url}#include[] directive.\nAlternatively, if you need to change them in any way, you can copy and paste their contents directly into your configuration.\n\nlink:conf/http.conf[http.conf]::\nThis snippet creates https://github.com/kjdev/nginx-keyval[keyval] variables and must be _included_ in the _http_ context.\n\nlink:conf/server.conf[server.conf]::\nThis snippet creates `/-/oidc/` and `/-/internal/` _locations_ and it should be _included_ in every _server_ context (aka virtual host) where you want to use OIDC.\n\nlink:conf/auth-access.conf[auth-access.conf]::\nThis snippet performs user access authorization using the OpenID Connect Authorization Code flow.\nIt should be _included_ either in _location_ or _server_ context.\nYou can use the *$oidc_allow* and *$oidc_deny* variables for fine-grained access control.\n\nlink:conf/auth-pages.conf[auth-pages.conf]::\nTBD\n\nlink:conf/auth-proxy.conf[auth-proxy.conf]::\nThis snippet realises OAuth proxy for a resource provider.\nIt should be _included_ either in _location_ or _server_ context.\n\nAll _auth-*.conf_ snippets uses the link:{ngx-docs-url}/ngx_http_auth_request_module.html#auth_request[auth_request] directive that performs a subrequest to one of the internal _locations_ defined in link:conf/server.conf[server.conf].\n\n\n=== Variables\n:oidc-connect-core-url: https://openid.net/specs/openid-connect-core-1_0.html\n:oidc-provider-metadata-url: https://openid.net/specs/openid-connect-discovery-1_0.html\n:oidc-provider-metadata-link: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata[Provider Metadata]\n:rfc6749-url: https://datatracker.ietf.org/doc/html/rfc6749\n:rfc7517-url: https://datatracker.ietf.org/doc/html/rfc7517\n:rfc7662-url: https://datatracker.ietf.org/doc/html/rfc7662\n:server-scheme-name-port: link:{ngx-http-core-url}#var_scheme[$scheme]://link:{ngx-http-core-url}#var_server_name[$server_name]:link:{ngx-http-core-url}#var_server_port[$server_port]\n\nThis module is configured using nginx _variables_, which can be set with link:{ngx-docs-url}/ngx_http_rewrite_module.html#set[set], link:{ngx-docs-url}/ngx_http_map_module.html#map[map] or link:{ngx-docs-url}/ngx_http_js_module.html#js_var[js_var] directives.\nAll variables should be set in the *server context* (or http context), unless specified otherwise.\n\n\n==== OIDC Provider\n\nThe information for the following configuration variables can be retrieved from the link:{oidc-provider-metadata-url}#ProviderMetadata[OpenID Provider Discovery Metadata] exposed by your Authorization Server or from its documentation.\n\n$oidc_issuer::\nURL that the OIDC Provider asserts as its Issuer Identifier.\nIt corresponds to property `issuer` in {oidc-provider-metadata-link}.\n+\nThis variable is *required*.\n\n$oidc_jwks_file::\nPath to the JSON file in the link:{rfc7517-url}#section-5[JWKS] format for validating JWT signature.\nThis file can be downloaded from the location specified by the `jwks_uri` property in {oidc-provider-metadata-link}.\n+\nThis variable is *required*.\n\n$oidc_authorization_endpoint::\nURL of the link:{rfc6749-url}#section-3.1[OAuth 2.0 Authorization Endpoint] at the Authorization Server.\nIt corresponds to property `authorization_endpoint` in {oidc-provider-metadata-link}.\n+\nThis variable is *required*.\n\n$oidc_token_endpoint::\nURL of the link:{rfc6749-url}#section-3.2[OAuth 2.0 Token Endpoint] at the Authorization Server.\nIt corresponds to property `token_endpoint` in {oidc-provider-metadata-link}.\n+\nThis variable is *required*.\n\n$oidc_introspection_endpoint::\nURL of the link:{rfc7662-url}#section-2[OAuth 2.0 Token Introspection Endpoint] at the Authorization Server.\nIt corresponds to property `introspection_endpoint` in {oidc-provider-metadata-link}.\n+\nThis variable is optional.\n\n$oidc_end_session_endpoint::\nURL of the link:{oidc-rp-init-logout-url}[Logout Endpoint] for the RP-Initiated Logout at the Authorization Server.\nIt corresponds to property `end_session_endpoint` in {oidc-provider-metadata-link}.\n+\nThis variable is optional.\n\n\n==== Client\n\n$oidc_client_id::\nOAuth 2.0 link:{rfc6749-url}#section-2.2[Client Identifier] registered at the Authorization Server.\n+\nThis variable is *required.*\n\n$oidc_client_secret::\nOAuth 2.0 link:{rfc6749-url}#section-2.3.1[Client Secret] (password) associated with the *$oidc_client_id*.\n+\nThis variable is *required.*\n\n$oidc_scope::\nA space-separated set of link:{rfc6749-url}#section-3.3[OAuth 2.0 scopes] that should be requested.\n+\nDefault is `openid`.\n\n$oidc_claim_username::\nThe link:{oidc-connect-core-url}#IDToken[ID Token] link:{oidc-connect-core-url}#StandardClaims[Claim] that contains the user’s unique identifier (typically a username).\nThis is used for access control (see *$oidc_allow*) and logging.\n+\nDefault is `preferred_username`.\n\n$oidc_claim_roles::\nThe link:{oidc-connect-core-url}#IDToken[ID Token] link:{oidc-connect-core-url}#StandardClaims[Claim] that contains the roles of the user (as a flat array).\nThis is used for access control (see *$oidc_allow*).\n+\nThis variable is optional.\n\n$oidc_redirect_uri::\nURL of the Client’s link:{rfc6749-url}#section-3.1.2[Redirection Endpoint] previously registered at the Authorization Server.\nIf only a path is provided (not an absolute URL), it will be prepended with `{server-scheme-name-port}`.\n+\nDefault is `/-/oidc/callback`, which corresponds to the _location_ in link:conf/server.conf[].\n\n$oidc_post_logout_redirect_uri::\nURL to which the user will be redirected after logging out.\nIf *$oidc_end_session_endpoint* is specified, then this URL will be passed to the Authorization Server’s link:{oidc-rp-init-logout-url}[Logout Endpoint] via the `post_logout_redirect_uri` parameter and it must be previously registered at the Authorization Server.\n+\nThis variable is optional.\n\n\n==== Others\n\n$oidc_allow::\nA whitespace-separated list of usernames and roles.\nIf the user has any of the specified roles or username, and has none of the roles or username specified in *$oidc_deny*, then access will be allowed.\nOtherwise, access will be denied.\n+\nThe user’s username and roles are retrieved from the ID Token as specified by *$oidc_claim_username* and *$oidc_claim_roles*.\nThere are also two special roles:\n+\n--\n* `ANONYMOUS` – no authentication is required, access is allowed to anyone.\n* `AUTHENTICATED` – any authenticated user is allowed.\n--\n+\nThis variable is used for link:conf/auth-access.conf[] and it can be set in the server or location context.\n+\nDefault is `AUTHENTICATED`.\n\n$oidc_deny::\nA whitespace-separated list of usernames and roles.\nIf the user has any of the specified roles or username, then access will be denied.\n+\nThe user’s username and roles are retrieved from the ID Token as specified by *$oidc_claim_username* and *$oidc_claim_roles*.\n+\nThis variable is used for link:conf/auth-access.conf[] and it can be set in the server or location context.\n+\nDefault is _empty_.\n\n$oidc_cache_zone_tokens::\nName of the {ngx-docs-url}/ngx_http_proxy_module.html#proxy_cache_path[proxy cache] keys_zone for caching tokens.\n+\nThis variable is *required.* footnote:[It has a default value in the module, but it must be defined for `proxy_cache` in link:conf/server.conf[].]\n\n$oidc_cookie_attrs::\nhttps://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#attributes[Set-Cookie attributes] to be added to the session cookies.\nSome attributes are overridden for certain cookies (_Max-Age_ and _Path_).\n+\nDefault is `Max-Age=2592000; Path=/; Secure; SameSite=lax`.footnote:[`SameSite=strict` doesn’t work with e.g. Microsoft ATP (that crap used when opening links from MS Teams) – `Set-Cookie` is not propagated.]\n\n$oidc_error_pages_dir::\nPath to the directory with error page templates.\nSee \u003c\u003cError Pages\u003e\u003e for more information.\n\n$oidc_log_level::\nThe log level threshold for messages logged by this module.\n+\nOne of: `debug`, `info`, `warn`, `error`.\nDefault is `info`.\n\n$oidc_log_prefix::\nThe prefix for log messages.\n+\nDefault is ``[oidc] ``.\n\n\n=== Error Pages\n\nTBD\n\n\n== License\n\nThis project is licensed under https://opensource.org/licenses/MIT[MIT License].\nFor the full text of the license, see the link:LICENSE[] file.\n\nThis README file is licensed under https://creativecommons.org/licenses/by/4.0[Creative Commons Attribution 4.0 International License].\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjirutka%2Fnginx-oidc-njs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjirutka%2Fnginx-oidc-njs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjirutka%2Fnginx-oidc-njs/lists"}