[{"_1":2,"_201":-5,"_202":-5},"loaderData",{"_3":4,"_13":14,"_20":21,"_174":175},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":11,"_17":11,"_18":19},"username","isBillingDecouplingSeatCount","isSearchBoxExperimentEnabled","isAskGordonEnabled",true,"routes/_layout.r.$namespace.$reponame",{"_22":23,"_24":-5,"_25":11,"_26":11,"_27":28,"_29":30,"_31":-5,"_32":11,"_33":34,"_94":95,"_119":120,"_167":-5,"_168":11,"_169":11,"_170":11,"_171":-5,"_172":173},"canonicalUrl","https://hub.docker.com/r/eclipse/che-jwtproxy/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","eclipse","reponame","che-jwtproxy","cloudBuildSource","isAutobuildsAvailable","repo",{"_35":36,"_48":49,"_51":52,"_53":54,"_55":11,"_56":57,"_58":59,"_60":61,"_38":30,"_27":28,"_63":64,"_65":50,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":76,"_77":11,"_78":28,"_79":80,"_85":19,"_86":87,"_91":28,"_92":93},"categories",[37,42,45],{"_38":39,"_40":41},"name","Security","slug","security",{"_38":43,"_40":44},"Integration & delivery","integration-and-delivery",{"_38":46,"_40":47},"API management","api-management","content_types",[50],"image","date_registered","2018-08-07T07:25:21.565719Z","description","eclipse che jwt proxy image","is_private","last_updated","2018-10-25T07:34:18.631827Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[62],"application/vnd.docker.container.image.v1+json","pull_count",54476254,"repository_type","star_count",2,"status",1,"status_description","active","source","collaborator_count",0,"full_description","# JWT Proxy\n\nThe JWT proxy is intended to be used as a complementary service for authenticating, and possibly authorizing requests made between services.\nThere is a forward proxy component, which can be configured to sign outgoing requests to another service, and a reverse proxy component, which can be used to authenticate incoming requests from another service.\n\n## JWT Forward Proxy\n\nThe JWT forward proxy is used to sign outgoing requests with a JWT using a private key.\n\n### Features\n\n- Append a JWT `Authorization` header containing claims about which service the request originated from, and who is the intended recipient\n- Autogenerate private signing keys, and publish the public portion to a server following the [key server specification](https://github.com/eclipse/che-jwtproxy/blob/master/jwt/keyserver/keyregistry/README.md)\n- Ability to use a preshared private key if we don't want to use autogenerated keys (useful when originating service is HA)\n- Ability to sign SSL requests using MITM SSL with configurable certificate authority\n\n### Potential Features\n\n- Ability to append static claims via config\n- Ability to read dynamic claims out of a request header and turn them into JWT claims\n\n### Limitations\n\n- When the proxy is configured to use MITM SSL, the `CONNECT` tunneling mechanism is only available to forward HTTPS requests. By default, most clients exclusively use `CONNECT` for HTTPS requests, which is 100% supported.\n\n## JWT Reverse Proxy\n\nThe JWT reverse proxy is used to verify incoming requests that were signed by the forward proxy.\n\n### Features\n\n- Ability to decode and verify JWT `Authorization` headers on incoming requests\n- Ability to verify the signature based on the specified signing key against a public key fetched from a [key server](https://github.com/eclipse/che-jwtproxy/blob/master/jwt/keyserver/keyregistry/README.md)\n- Ability to verify from a single issuer using a pre-shared public key (likely only useful for testing)\n- Ability to verify SSL requests by doing SSL termination on behalf of the upstream\n- Pluggable claims verifier interface, with bundled static claims verifier implementation\n\n## Usage\n\nRun with:\n\n```bash\njwtproxy -config config.yaml\n```\n\nThe configuration yaml file contains a `jwtproxy` top level config flag, which allows a single yaml file to be used to configure multiple services. The presence or absence of a signer config or verifier config block will enable the forward and reverse proxy respectively.\n\n```yaml\njwtproxy:\n \n\n verifier_proxies:\n - \n - \n```\n\n### Examples\n\nUsage examples are provided in the [examples](examples/) folder.\n\n### Signer Config\n\nConfigures and enables the JWT forward signing proxy.\n\n```yaml\njwtproxy:\n signer_proxy:\n enabled: \n\n # Addr at which to bind proxy server\n listen_addr: \n shutdown_timeout: \n\n # Optional key and CA certificate to forge MITM SSL certificates\n ca_key_file: \n ca_crt_file: \n\n # Certificates to be trusted by the proxy when its MITM mechanism communicates with remotes.\n # This is optional. Specifying it currently replaces system root certificates entirely.\n trusted_certificates: <[]string|system root certificates>\n\n # Whether the remotes' certificate chain and host name should be verified.\n insecure_skip_verify: \n\n signer:\n # Signing service name\n issuer: \n\n # Validity duration\n expiration_time: \n\n # How much time skew we allow between signer and verifier\n max_skew: \n\n # Length of random nonce values\n nonce_length: \n\n # Registerable private key source type\n private_key:\n type: \n options: \n```\n\n#### Autogenerated Private Key\n\nConfigures a private key source which generates key pairs automatically and publishes them to a key server.\n\n```yaml\nprivate_key:\n type: autogenerated\n options:\n # How often we publish a new key\n rotate_every: \n\n # Folder in which to store autogenerated keys on disk\n key_folder: \n\n # Registerable key server and config at which to publish public keys\n key_server:\n type: \n options: \n```\n\n#### Key Registry Key Server\n\nConfigures a key server which talks to a server which implements the key registry protocol.\n\n```yaml\nkey_server:\n type: keyregistry\n options:\n # Base URL from which to access key registry endpoints.\n registry: \n```\n\n#### Preshared Private Key\n\nConfigures a private key source which simply uses the key files specified.\n\n```yaml\nprivate_key:\n type: preshared\n options:\n # Unique identifier for the private key\n key_id: \n\n # Location of PEM encoded private key file\n private_key_path: \n```\n\n### Verifier Config\n\nConfigures and enables one or more JWT verifying reverse proxyies.\n\n```yaml\njwtproxy:\n verifier_proxies:\n - enabled: \n\n # Addr at which to listen for requests\n # It can either be an HTTP(s) URL or an UNIX socket path prefixed by 'unix:'\n listen_addr: \n shutdown_timeout: \n\n # Optional PEM private key and certificate files for SSL termination\n key_file: \n crt_file: \n\n verifier:\n # Upstream server to which to forward requests\n # It can either be an HTTP(s) URL or an UNIX socket path prefixed by 'unix:'\n upstream: \n\n # Required value for audience claim,\n # Usually our advertised protocol and hostname\n audience: \n\n # How much time skew we allow between signer and verifier\n max_skew: \n\n # Maximum total amount of time for which a JWT can be signed\n max_ttl: \n\n # List of paths which should be proxied without authentication\n excludes: <[]string|nil>\n\n # URL where unauthenticated requests should be redirected to\n # If null then 403 response code will be responded without redirection\n auth_redirect_url: \n\n # Configures whether token should be searched in cookie `access_token`\n # `false` by default, so JwtProxy ignores token specified in cookies\n cookies_enabled: \n\n # Registerable key server type and options used to fetch\n # public keys for verifying signatures\n key_server:\n type: \n options: \n\n # Registerable type and options where we track used nonces\n nonce_storage:\n type: \n options: \n```\n\n#### Key Registry Key Server\n\nConfigures a key server which fetches public keys from a server which implements the key registry protocol.\n\n```yaml\nkey_server:\n type: keyregistry\n options:\n # Base URL from which to access key registry endpoints.\n registry: \n\n # Optional cache config to alleviate load on the key server.\n cache:\n # How long the keys stay valid in the cache\n duration: \n\n # How often expired keys are removed from memory\n purge_interval: \n```\n\n#### Preshared Key Server (Testing Only)\n\nConfigures a local preshared mock key server which can return one and only one public key. This should probably be used **only for testing**.\n\n```yaml\nkey_server:\n type: preshared\n options:\n # Configures the only issuer we will allow\n issuer: \n\n # Unique ID of the only key from which we validate requests\n key_id: \n\n # File path to the PEM encoded public key to verify signatures\n public_key_path: \n```\n\n#### Local Nonce Storage\n\nConfigures nonce storage which stores previously seen nonces in a TTL cache in memory.\n\n```yaml\nnonce_storage:\n type: local\n options:\n # How often we run the cache janitor to clean up expired nonces\n purge_interval: \n```\n\n#### Void Nonce Storage\n\nConfigures void storage which does not do any storing or validating of nonces.\nSupposed to be used when no strict 'jti' claim uniqueness verification needed.\n\n```yaml\nnonce_storage:\n type: void\n```\n\n### Generate keys\n\n## Generate forward proxy's CA certificate and private key\n\nWhen it comes to sign HTTPs requests, the forward proxy must *hijack* connections and act as a man-in-the-middle.\nTherefore, the proxy requires a CA certificate and private key in order to forge TLS/SSL certificates on behalf on the remote HTTPs server.\nIf none are specified, the forward proxy will throw a warning at startup and refuse to proxy HTTPs requests.\n\nThe following commands generate both, valid for a year, without any passphrase (otherwise, the proxy would require us to type it).\n\n```\nopenssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ca.key -out ca.crt\n```\n\nThe certificate then has to be distributed and trusted by every clients that goes through the forward proxy.\nThe private key must remain secret.\n\nThe CA certificate and private key should be specified using the `ca_key_file` and `ca_crt_file` parameters in the [Signer configuration](#signer-config).\n\n## Generate reverse proxy's key pair\n\nTo confirm reverse proxy's authenticity and to guarantee confidentiality and integrity of the exchanged data, the reverse proxy can terminate TLS/SSL using a public/private key pair.\nThe key pair could either be provided by a trusted certificate authority or self-signed using the commands below:\n\n```\nopenssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout reverseProxy.key -out reverseProxy.crt\n```\n\nNote that to the question `Common Name (e.g. server FQDN or YOUR name)`, you must write the host that you expect to use for the reverse proxy.\n\nThe key pair should be specified using the `key_file` and `crt_file` parameters in the [Verifier configuration](#verifier-config).\nAlso, because the key pair is self-signed, the certificate must be trusted by the forward proxy. This can be done by trusting the certificate system-wide or by specifying it using the `trusted_certificates` list parameter in the [Signer configuration](#signer-config).\n\n## Run go tests\n\nRun tests in project with:\n```bash\ngo test ./...\n```\n\n## Build Linux Binary file locally\n\nBuild Binary file locally with:\n```\ngo build -o jwtproxy cmd/jwtproxy/main.go\n```\n\nThen you'll be able to run it with:\n```\n./jwtproxy -config config.yaml\n```\n\n## Build JwtProxy docker image\n\nBuild JwtProxy docker image with:\n```\ndocker build -t jwtproxy .\n```\n\nThen you'll be able to run it with:\n```\ndocker run -it -v /local/folder/with/jwtproxy/:/config jwtproxy -config /config/config.yaml\n```\n","has_starred","hub_user","immutable_tags_settings",{"_81":11,"_82":83},"enabled","rules",[84],".*","is_automated","permissions",{"_88":19,"_89":11,"_90":11},"read","write","admin","user","storage_size",27617418,"orgData",{"_96":97,"_98":99,"_100":101,"_102":28,"_103":104,"_105":106,"_107":104,"_108":109,"_110":111,"_112":113,"_114":115,"_116":117,"_118":19},"id","3c0a58fdea0b4339bd0711c4cc2fd351","uuid","3c0a58fd-ea0b-4339-bd07-11c4cc2fd351","type","organization","orgname","full_name","The Eclipse Foundation","location","Ottawa, Canada","company","profile_url","http://www.eclipse.org","date_joined","2015-02-08T12:49:37.994822Z","gravatar_url","https://www.gravatar.com/avatar/9a74fa86dc4413032fb9505219b0dc89?s=80&r=g&d=mm","gravatar_email","","badge","open_source","is_active","recentTags",[121,157],{"_122":50,"_123":124,"_125":126,"_96":127,"_128":129,"_56":146,"_147":124,"_148":28,"_149":62,"_38":150,"_151":152,"_153":137,"_154":146,"_155":71,"_156":19},"content_type","creator",213944,"full_size",4437955,32571740,"images",[130],{"_131":132,"_133":134,"_135":115,"_136":137,"_138":139,"_140":141,"_142":115,"_143":-5,"_144":126,"_68":71,"_145":-5},"architecture","amd64","digest","sha256:f63d0d79386b6e3ed26d1b2d9f62ed3cf14fa98e3f1d3e6f71458d6de5e3dc15","features","last_pulled","2026-07-16T00:52:35.82104951Z","last_pushed","2018-10-25T07:34:18Z","os","linux","os_features","os_version","size","variant","2018-10-25T07:34:17.942638Z","last_updater","last_updater_username","media_type","latest","repository",5844763,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_122":50,"_123":124,"_125":158,"_96":159,"_128":160,"_56":165,"_147":124,"_148":28,"_149":62,"_38":166,"_151":152,"_153":163,"_154":165,"_155":71,"_156":19},4451471,32635316,[161],{"_131":132,"_133":162,"_135":115,"_136":163,"_138":164,"_140":141,"_142":115,"_143":-5,"_144":158,"_68":71,"_145":-5},"sha256:69128866a5e06d70250972f7f67c9d03cdc9d09c82fbf6feb846b648700aef54","2026-07-15T06:46:15.655184149Z","2018-08-08T06:29:29Z","2018-08-08T06:29:28.339686Z","0.0.1","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_33":176,"_186":187,"_172":199,"_200":11},{"_35":177,"_48":181,"_51":52,"_53":54,"_55":11,"_56":57,"_58":59,"_60":182,"_38":30,"_27":28,"_63":64,"_65":50,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":76,"_77":11,"_78":28,"_79":183,"_85":19,"_86":185,"_91":28,"_92":93},[178,179,180],{"_38":39,"_40":41},{"_38":43,"_40":44},{"_38":46,"_40":47},[50],[62],{"_81":11,"_82":184},[84],{"_88":19,"_89":11,"_90":11},"tags",{"_188":67,"_189":-5,"_190":-5,"_191":192},"count","next","previous","results",[193,196],{"_122":50,"_123":124,"_125":126,"_96":127,"_128":194,"_56":146,"_147":124,"_148":28,"_149":62,"_38":150,"_151":152,"_153":137,"_154":146,"_155":71,"_156":19},[195],{"_131":132,"_133":134,"_135":115,"_136":137,"_138":139,"_140":141,"_142":115,"_143":-5,"_144":126,"_68":71,"_145":-5},{"_122":50,"_123":124,"_125":158,"_96":159,"_128":197,"_56":165,"_147":124,"_148":28,"_149":62,"_38":166,"_151":152,"_153":163,"_154":165,"_155":71,"_156":19},[198],{"_131":132,"_133":162,"_135":115,"_136":163,"_138":164,"_140":141,"_142":115,"_143":-5,"_144":158,"_68":71,"_145":-5},[],"canDeleteTags","actionData","errors"]

eclipse/che-jwtproxy

Tags for eclipse/che-jwtproxy