Behind a reverse proxy

​

Give Veriqa a host name of its own

​

Paths

​

WebSocket

​

NGINX

# http context
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl;
    http2 on;
    server_name auth.your-domain.com;

    ssl_certificate     /etc/nginx/certs/server.crt;
    ssl_certificate_key /etc/nginx/certs/server.key;

    # Sign-in requests carry cookies; the 8k default answers 400 on a longer header
    large_client_header_buffers 4 32k;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;

        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket of the sign-in page
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        proxy_read_timeout 300s;
    }
}

location ~ ^/(\.well-known|connect|auth|hubs|api/transaction|api/channels|_content)/ {
    # the same proxy_* directives as above
}

​

Under a path prefix

# The path is passed as it is: Veriqa receives /auth/veriqa/connect/token
location /auth/veriqa/ {
    proxy_pass http://127.0.0.1:8080;
    # the same proxy_* directives as above
}

# The prefix is trimmed: Veriqa receives /connect/token
location /auth/veriqa/ {
    proxy_pass http://127.0.0.1:8080/;
    # the same proxy_* directives as above
}

location = /.well-known/oauth-authorization-server/auth/veriqa {
    proxy_pass http://127.0.0.1:8080/auth/veriqa/.well-known/oauth-authorization-server;
    proxy_set_header Host              $host;
    proxy_set_header X-Forwarded-Proto $scheme;
}

• A prefix that a path of Veriqa itself starts with — /auth, /api, /connect, /hubs, /_content, /health, or the path of hop links (/r by default, Veriqa:HopMode:HopPath) — works only when the proxy passes the path as it is. Behind a trimming proxy such a prefix answers 404. /auth/veriqa is not one of them.
• Requests that reach an instance directly go without the prefix — a health probe asks http://127.0.0.1:8080/health/live. Veriqa cannot tell such a request from one the proxy trimmed and serves both, so closing the root of the instance from the outside is the job of the proxy.
• Several instances. The proxy has to keep a browser on one instance (session affinity, ip_hash in NGINX): without it the hub of the sign-in page does not connect. The Email channel has a limit of its own — the multi-instance caveat in Channel setup, Email. Neither depends on the prefix.
• Verified under a prefix: the sign-in by Email in both modes with its inbound webhook, the messenger webhook (Webhook mode), the phone number request, confirming an email address by a code or by a message the user sends during claim enrichment, the tokens and userinfo, the form that collects a missing profile field, and a confirmation transaction created by your server. The messenger part was checked on Telegram only.

​

Other proxies

​

Check

• https://auth.your-domain.com/.well-known/openid-configuration returns https URLs on your host name. http URLs or invalid_request mean the proxy is not trusted — self-hosted, step 6.
• On the sign-in page the browser’s network tab shows /hubs/auth answered with 101 Switching Protocols.
• Request Header Or Cookie Too Large — raise large_client_header_buffers.