Struct ForwardAuthPlugin 

pub struct ForwardAuthPlugin {
    uri: String,
    method: Method,
    is_post: bool,
    request_headers: Vec<String>,
    upstream_headers: Vec<String>,
    client_headers: Vec<String>,
    extra_headers: Vec<(String, String)>,
    ssl_verify: bool,
    timeout: Duration,
    status_on_error: u16,
    allow_degradation: bool,
    client: Arc<OutboundClient>,
}

Sends each request to an external authorization endpoint and routes on its verdict: 2xx continues (success port), non-2xx or (non-degrading) callout failure rejects (error port).

Fields

uri: String

External authorization endpoint.

method: Method

Callout method (GET or POST); POST forwards the client body.

is_post: bool

Whether the callout is a POST (forwards the client body).

request_headers: Vec<String>

Client request header names copied onto the callout (lowercased).

upstream_headers: Vec<String>

Auth-response header names copied onto the request forwarded upstream on success (lowercased).

client_headers: Vec<String>

Auth-response header names copied onto the client-facing response on failure (lowercased).

extra_headers: Vec<(String, String)>

Extra callout headers whose values may reference $var templates.

ssl_verify: bool

TLS certificate verification for https callouts.

timeout: Duration

Whole-call callout deadline.

status_on_error: u16

Status returned when the callout fails and degradation is disabled.

allow_degradation: bool

When true, a callout failure lets the request through instead of rejecting it.

client: Arc<OutboundClient>

Shared pooled HTTP client (from PluginResources).

Implementations

impl ForwardAuthPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• uri (string, required): external authorization endpoint. A missing uri is a config-load error.
• request_method (string, default GET): callout method; GET or POST. When POST, the buffered client body is forwarded and the client’s Content-Encoding header is preserved on the callout.
• request_headers (array of strings, default []): client header names forwarded to the authorization service (looked up case-insensitively).
• upstream_headers (array of strings, default []): auth-response header names copied onto the request forwarded upstream on success. A configured name absent from the auth response removes any client-supplied value.
• client_headers (array of strings, default []): auth-response header names copied onto the client-facing response on failure.
• extra_headers (object of string→string, optional): additional callout headers; values support $var / ${var} interpolation (e.g. $remote_addr, $request_uri).
• ssl_verify (bool, default true): verify TLS certificates for https callouts.
• timeout (integer ms, default 3000): whole-call callout deadline.
• status_on_error (integer, default 403): status returned when the callout fails and allow_degradation is false.
• allow_degradation (bool, default false): when true, a callout failure lets the request continue instead of rejecting it.

type: forward-auth
config:
  uri: http://auth-service:8080/verify
  request_method: GET
  request_headers: [authorization, cookie]
  upstream_headers: [x-user-id]
  client_headers: [www-authenticate]
  ssl_verify: true
  timeout: 3000
  status_on_error: 403
  allow_degradation: false

fn build_callout_headers(&self, ctx: &Context) -> Vec<(String, String)>

Builds the header list sent on the callout to the authorization service: the X-Forwarded-* forwarding set, Content-Encoding for POST, any interpolated extra_headers, and the configured request_headers copied from the client request.

fn apply_allow( &self, ctx: &mut Context, resp_headers: &HashMap<String, Vec<String>>, )

On a 2xx auth reply, copies the configured upstream_headers from the auth response onto the request forwarded upstream. A configured header absent from the auth response removes any client-supplied value.

fn build_deny( &self, ctx: Context, status: u16, body: Bytes, resp_headers: &HashMap<String, Vec<String>>, ) -> PluginExecutionError

On a non-2xx auth reply, mirrors the auth service’s status and body onto the client-facing response, copies the configured client_headers, and returns the FORWARD_AUTH_DENIED rejection carrying the context.

fn build_error(&self, ctx: Context, message: String) -> PluginExecutionError

Builds the FORWARD_AUTH_ERROR rejection used when the callout fails and degradation is disabled.

Trait Implementations

impl Plugin for ForwardAuthPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.