JWT

The module enables validation of JSON Web Tokens (JWT) using provided keys. It is incompatible with the Auth JWT module.

Loading the Module

Enable the module in the main{} context:

load_module modules/ngx_http_auth_jwt_module.so;

Configuration Example

http {
    server {
        auth_jwt_key "0123456789abcdef" hex;
        auth_jwt     off;

        # Default JWT authentication using the "Authentication" header
        location /secured-by-auth-header/ {
            auth_jwt on;
        }

        # JWT authentication using a cookie
        location /secured-by-cookie/ {
            auth_jwt $cookie_MyCookieName;
        }

        # Inherit JWT keys, but can override per location
        location /secured-by-auth-header-too/ {
            auth_jwt_key "another-secret";
            auth_jwt on;
        }

        # Use RSA public key for verification
        location /secured-by-rsa-key/ {
            auth_jwt_key /etc/keys/rsa-public.pem file;
            auth_jwt on;
        }

        location /not-secure/ {}
    }
}

Additional Information

For more details and source code, see: max-lt/nginx-jwt-module