{"id":26164728,"url":"https://github.com/optum/kong-upstream-jwt","last_synced_at":"2026-03-05T22:08:15.675Z","repository":{"id":48235677,"uuid":"118021041","full_name":"Optum/kong-upstream-jwt","owner":"Optum","description":"A plugin for Kong which adds a signed JWT to HTTP Headers to backend requests","archived":false,"fork":false,"pushed_at":"2023-08-10T03:31:14.000Z","size":1134,"stargazers_count":46,"open_issues_count":10,"forks_count":23,"subscribers_count":13,"default_branch":"master","last_synced_at":"2025-04-14T15:22:16.789Z","etag":null,"topics":["api-gateway","kong","optum"],"latest_commit_sha":null,"homepage":"","language":"Lua","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Optum.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-01-18T18:23:34.000Z","updated_at":"2025-03-07T02:37:18.000Z","dependencies_parsed_at":"2025-03-11T15:42:29.908Z","dependency_job_id":"b235e32b-fc4f-4a1d-92ec-359efe303784","html_url":"https://github.com/Optum/kong-upstream-jwt","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Optum/kong-upstream-jwt","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Optum%2Fkong-upstream-jwt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Optum%2Fkong-upstream-jwt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Optum%2Fkong-upstream-jwt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Optum%2Fkong-upstream-jwt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Optum","download_url":"https://codeload.github.com/Optum/kong-upstream-jwt/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Optum%2Fkong-upstream-jwt/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30152080,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-05T21:15:50.531Z","status":"ssl_error","status_checked_at":"2026-03-05T21:15:11.173Z","response_time":93,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api-gateway","kong","optum"],"created_at":"2025-03-11T15:40:00.445Z","updated_at":"2026-03-05T22:08:15.653Z","avatar_url":"https://github.com/Optum.png","language":"Lua","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Kong Upstream JWT Plugin\n## Overview\nThis plugin will add a signed JWT into the HTTP Header `JWT` or `config.header` of proxied requests through the Kong gateway. The purpose of this, is to provide means of _Authentication_, _Authorization_ and _Non-Repudiation_ to API providers (APIs for which Kong is a gateway).\n\nIn short, API Providers need a means of cryptographically validating that requests they receive were A. proxied by Kong, and B. not tampered with during transmission from Kong -\u003e API Provider. This token accomplishes both as follows:\n1. **Authentication** \u0026 **Authorization** - Provided by means of JWT signature validation. The API Provider will validate the signature on the JWT token (which is generating using Kong's RSA x509 private key), using Kong's public key. This public key can be maintained in a keystore, or sent with the token - provided API providers validate the signature chain against their truststore.\n2. **Non-Repudiation** - SHA256 is used to hash the body of the HTTP Request Body, and the resulting digest is included in the `payloadhash` element of the JWT body. API Providers will take the SHA256 hash of the HTTP Request Body, and compare the digest to that found in the JWT. If they are identical, the request remained intact during transmission.\n\n## Supported Kong Releases\nKong \u003e= 3.x\n\n## Installation\nRecommended:\n```\n$ luarocks install kong-upstream-jwt\n```\nOther:\n```\n$ git clone https://github.com/Optum/kong-upstream-jwt.git /path/to/kong/plugins/kong-upstream-jwt\n$ cd /path/to/kong/plugins/kong-upstream-jwt\n$ luarocks make *.rockspec\n```\n\n## JWT Token\nThe following is an example of the contents of the decoded JWT token:\n\n**Header:**\n```json\n{\n  \"x5c\": [\"...der-encoded cert data...\"],\n  \"alg\": \"RS256\",\n  \"typ\": \"JWT\",\n  \"kid\": \"..conf.key_id..\" // Only present if conf.key_id configuration variable set\n}\n```\n\n**Payload:**\n```json\n{\n  \"aud\": \"kong-service-name\", // The Kong Service Name\n  \"iss\": \"issuer\", // Only set if issuer configuration variable available\n  \"iat\": 1550258274, // Only set if issuer configuration variable available\n  \"exp\": 1550258334, // 1 minute exp time\n  \"jti\": \"d4f10edb-c4f0-47d3-b7e0-90a30a885a0b\", // Unique to every request - UUID\n  \"consumername\": \"consumer-username\", // Consumer Username\n  \"consumerid\": \"consumer-id\", // Consumer ID\n  \"payloadhash\": \"...sha256 hash of request payload...\"\n}\n```\n\n## Configuration\n\n### Private and Public Keys\nThe plugin requires that Kong's private key be accessible in order to sign the JWT. [We also include the x509 cert in the `x5c` JWT Header for use by API providers to validate the JWT](https://tools.ietf.org/html/rfc7515#section-4.1.6).\n\n### JWT Issuer\n[JWT Issuer](https://tools.ietf.org/html/rfc7519#section-4.1.1) allows for the `iss` field to be set within the `JWT` token.\n\nMore information about JWT claims can be found [here](https://tools.ietf.org/html/rfc7519#section-4)\n\n**Optional Plugin schema configurations:**\n```\nprivate_key_location = \"/path/to/kong/ssl/privatekey.key\"\npublic_key_location = \"/path/to/kong/ssl/kongpublickey.cer\"\nissuer = \"issuer\"\nkey_id = \"keyId\"\nheader = \"JWT\" //If you want to set the header key to something other than JWT\ninclude_credential_type = false //Controls \"Bearer \" + JWT or just JWT in header\n```\n\nThe first contains the path to your .key file, the second specifies the path to your public key in DER format .cer file.\n\n#### Backwards Compatibility\nTo maintain backwards compatibility, support for passing the key locations through environment variables is also available.  We access these via Kong's overriding environment variables `KONG_SSL_CERT_KEY` for the private key as well as `KONG_SSL_CERT_DER` for the public key.\n\n**If not already set, these can be done so as follows:**\n```\n$ export KONG_SSL_CERT_KEY=\"/path/to/kong/ssl/privatekey.key\"\n$ export KONG_SSL_CERT_DER=\"/path/to/kong/ssl/kongpublickey.cer\"\n```\n\n**One last step** is to make the environment variables accessible by an nginx worker. To do this, simply add these line to your _nginx.conf_\n```\nenv KONG_SSL_CERT_KEY;\nenv KONG_SSL_CERT_DER;\n```\n\n## Maintainers\n[jeremyjpj0916](https://github.com/jeremyjpj0916)  \n[rsbrisci](https://github.com/rsbrisci)  \n\nFeel free to open issues, or refer to our [Contribution Guidelines](https://github.com/Optum/kong-upstream-jwt/blob/master/CONTRIBUTING.md) if you have any questions.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foptum%2Fkong-upstream-jwt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Foptum%2Fkong-upstream-jwt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foptum%2Fkong-upstream-jwt/lists"}