Hello I am trying to make Ory Oathkeeper work behind nginx b Ory Community #ory-selfhosting

Hello, I am trying to make Ory Oathkeeper work be...

alert-room-61990

11/09/2025, 9:25 AM

Hello, I am trying to make Ory Oathkeeper work behind nginx, but to no avail. Using a similar approach as the example from Github leads to no result (nginx is not even forwarding requests to Oathkeeper in that case). The problem seems to be in my Oathkeeper config, so I tried forgetting about nginx. Here is my rules array as returned by Oathkeeper's endpoint /rules:

Copy code

[{"id":"api-cs-rule","version":"v0.40.9","description":"","match":{"methods":["GET","POST","PATCH","PUT","DELETE"],"url":"\u003c^/api/cs/.*$\u003e"},"authenticators":[{"handler":"cookie_session","config":null}],"authorizer":{"handler":"allow","config":null},"mutators":[{"handler":"id_token","config":null}],"errors":null,"upstream":{"preserve_host":false,"strip_path":"","url":"<http://cs-api:8080>"}}]

Then, if I try the following request:

Copy code

curl -H "X-Forwarded-Proto: https" \
     -H "X-Forwarded-Method: GET" \
     -H "X-Forwarded-Host: localhost" \
     -H "X-Forwarded-Uri: /api/cs/users/123" \
     -X GET <http://localhost:4456/decisions>

It always replies with:

Copy code

{
  "error": {
    "code": 404,
    "status": "Not Found",
    "message": "Requested url does not match any rules"
  }
}

I have tried many variation of the rule, including: • setting the match URL to

<https://localhost/api/cs/><^.*$>

✅ 1

alert-room-61990

11/09/2025, 9:31 AM

After tinkering with the help of ChatGPT, it appeared that the following rule works:

Copy code

"url": "<^https?://localhost(:443)?/api/cs/.*$>",

Not sure to understand why the entire string needs to be in a regexp (but maybe that's also the port?)

alert-room-61990

11/09/2025, 9:35 AM

And for the record, this is a working nginx config correpsonding to the above:

Copy code

location /api/cs/ {
        auth_request /decisions;
        auth_request_set $next_uri $upstream_http_X_Original_URI;
        rewrite ^/api/cs/(.*)$ /$1 break;
        proxy_pass <http://cs-api:8080>;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    location = /decisions {
        internal;
        proxy_pass <http://cs-oathkeeper:4456/decisions>;
        proxy_pass_request_body   off;
        proxy_set_header Content-Length   "";
        proxy_set_header Host $http_host;
        proxy_set_header X-Original-URI $request_uri;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Method $request_method;
        proxy_set_header X-Forwarded-Uri $request_uri;
    }

steep-lamp-91158

11/10/2025, 9:53 AM

I think it was

\u003c

and

\u003e

because you need literal

<>

also the url does not start with

, but with scheme, host, port, so you need at least

<^.*/api/cs/.*$>

alert-room-61990

11/10/2025, 11:00 AM

Hello @steep-lamp-91158, thanks for your answer. My rule does contain "<" and ">" but Ory endpoint returns it with the unicode point \u003c and \u003e instead (or it is an artifact in the terminal). At least with my working setup right now, the call to the /rules endpoint still returns the "\u003c" and "\u003e" and it works -> not the root cause of the initial problem. Regarding the point around the matching url, indeed, that was the issue. I had difficulties finding the right combination of headers to forward from nginx to Ory Oathkeeper to make it work (it seems I do need to forward the protocol, port, host, forwarded uri and original uri).

17 Views

Open in Slack

Previous Next