mirror of
https://github.com/advplyr/audiobookshelf.git
synced 2026-05-30 23:40:40 +02:00
[PR #4708] Add proxy authentication method #4321
Assignees
adam (Adam Melkus)
Clear assignees
adam (Adam Melkus)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/audiobookshelf#4321
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
📋 Pull Request Information
Original PR: https://github.com/advplyr/audiobookshelf/pull/4708
Author: @alex-sviridov
Created: 9/29/2025
Status: 🔄 Open
Base:
master← Head:oauth2-proxy-integration📝 Commits (3)
4875125feat: proxy authenfication added96c5a51refactored proxuauthstrategy and added some env variables09ab781fix: missing function📊 Changes
9 files changed (+319 additions, -2 deletions)
View changed files
📝
client/pages/config/authentication.vue(+73 -1)📝
client/pages/login.vue(+31 -0)📝
client/strings/en-us.json(+5 -0)📝
index.js(+3 -0)📝
server/Auth.js(+54 -0)➕
server/auth/ProxyAuthStrategy.js(+95 -0)📝
server/controllers/MiscController.js(+27 -0)📝
server/objects/settings/ServerSettings.js(+30 -1)📝
server/routers/ApiRouter.js(+1 -0)📄 Description
Brief summary
Implements new Proxy authentication strategy, when authentication is made on reverse proxy side and request to the ABS is coming with the username in header.
Which issue is fixed?
N/A
In-depth Description
Implemented a new authentication method that integrates with external web proxies. The proxy authenticates users and passes the username via a signed header field. If the username exists in the database, the user is automatically logged in.
Configuration is available through Settings > Authentication or via environment variables at server startup.
It is especially useful in home lab\small office environment, when you can use single oauth2-proxy (or other piece of software) to control access to all your websites.
There's a link to a non-existing proxy authentication guide, I'll create two guides with oauth2-proxy as ure proxy, and for nginx as proxy and oauth2-proxy as authenticator.
How have you tested this?
The logic can be tested using the following docker compose. It allows to access ABS directly (no middleware\proxy) and via oauth2-proxy. The system behavior can be tested and compared accessing directly (password needed) and via oauth2-proxy (authenfication using github provider).
Github token for your application can be configured on this page Developer Settings
`
services:
audiobookshelf:
image: b0807783e3a5
networks:
- internal
environment:
- AUTH_PROXY_ENABLED=true
- AUTH_PROXY_HEADER_NAME=X-Forwarded-User
- AUTH_PROXY_LOGOUT_URL=/oauth2/sign_out
ports:
- 3000:80
restart: unless-stopped
oauth2:
image: quay.io/oauth2-proxy/oauth2-proxy:latest
networks:
- internal
environment:
- OAUTH2_PROXY_HTTP_ADDRESS=http://0.0.0.0:4000
- OAUTH2_PROXY_UPSTREAMS=http://audiobookshelf:80/audiobookshelf/
- OAUTH2_PROXY_REVERSE_PROXY=true
- OAUTH2_PROXY_REDIRECT_URL=http://127.0.0.1:4000/oauth2/callback
- OAUTH2_PROXY_PROVIDER_DISPLAY_NAME=GitHub
- OAUTH2_PROXY_PROVIDER=github
- OAUTH2_PROXY_GITHUB_USER=${GITHUB_USER}
- OAUTH2_PROXY_OIDC_ISSUER_URL=https://token.actions.githubusercontent.com
- OAUTH2_PROXY_CLIENT_ID=${GITHUB_CLIENT_ID}
- OAUTH2_PROXY_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}
- OAUTH2_PROXY_EMAIL_DOMAINS=*
- OAUTH2_PROXY_COOKIE_SECRET=${RANDOM_32B_SECRET}
- OAUTH2_PROXY_COOKIE_SECURE=false
- OAUTH2_PROXY_SET_AUTHORIZATION_HEADER=true
ports:
- 4000:4180
restart: unless-stopped
networks:
internal:
`
Screenshots
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.