[Enhancement]: Support Reverse Proxy Authentication / Forward Authentication #706

New issue

Open

opened 2025-10-14 17:14:44 -06:00 by navan · 0 comments

navan commented

2025-10-14 17:14:44 -06:00

Owner

Originally created by @balki on 2/5/2025

Type of Enhancement

Server Backend

Describe the Feature/Enhancement

Add a new type of authentication called Reverse Proxy Authentication.
When this type is enabled and the http request contains a header X-WEBAUTH-USER, if the user exists in abs, automatically login the user.

For ref: gitea supports this: https://docs.gitea.com/administration/authentication#reverse-proxy

Why would this be helpful?

tailscale and similar mesh networks are popular with selfhosters. In those cases the device is already authenticated with wireguard. Additional passwords or authentication is not needed. Example caddy(a reverse proxy web server) config:

audiobookshelf.example.com {
    @alice_phone client_ip 100.64.68.1
    @alice_lap client_ip 100.64.68.2
    @bob_phone client_ip 100.64.68.3

    @not_ts not client_ip 100.64.0.0/16
    
    request_header @alice_phone X-WEBAUTH-USER alice
    request_header @alice_lap X-WEBAUTH-USER alice
    request_header @bob_phone X-WEBAUTH-USER bob

   # Remove for others
    request_header @not_ts -X-WEBAUTH-USER

   reverse_proxy 127.0.0.1:5678
}

Future Implementation (Screenshot)

Just another checkbox in the list of supported authentication methods

Audiobookshelf Server Version

v2.19.0

Current Implementation (Screenshot)

I am not sure if this is already possible with OIDC or with the pull #3302 . If so, please document what is the header that needs to be set.

*Originally created by @balki on 2/5/2025* ### Type of Enhancement Server Backend ### Describe the Feature/Enhancement Add a new type of authentication called `Reverse Proxy Authentication`. When this type is enabled and the http request contains a header `X-WEBAUTH-USER`, if the user exists in abs, automatically login the user. For ref: gitea supports this: https://docs.gitea.com/administration/authentication#reverse-proxy ### Why would this be helpful? tailscale and similar mesh networks are popular with selfhosters. In those cases the device is already authenticated with wireguard. Additional passwords or authentication is not needed. Example [caddy](https://caddyserver.com/)(a reverse proxy web server) config: ```caddyfile audiobookshelf.example.com { @alice_phone client_ip 100.64.68.1 @alice_lap client_ip 100.64.68.2 @bob_phone client_ip 100.64.68.3 @not_ts not client_ip 100.64.0.0/16 request_header @alice_phone X-WEBAUTH-USER alice request_header @alice_lap X-WEBAUTH-USER alice request_header @bob_phone X-WEBAUTH-USER bob # Remove for others request_header @not_ts -X-WEBAUTH-USER reverse_proxy 127.0.0.1:5678 } ``` ### Future Implementation (Screenshot) Just another checkbox in the list of supported authentication methods ### Audiobookshelf Server Version v2.19.0 ### Current Implementation (Screenshot) I am not sure if this is already possible with OIDC or with the pull #3302 . If so, please document what is the header that needs to be set.