Support within limit_except - is it possible?

[col-panic]

According to the nginx documentation, their version of the jwt auth as delivered with the commercial subscription is usable within the limit_except configuration part.

This is very useful, if for example, I want to generally allow GET request, but want to limit PUT requests, which would be configured like this

 location ^~ /somelocation/ {
        dav_methods PUT DELETE;
        dav_access user:rw group:rw all:r;
        client_max_body_size 1M;

        autoindex on;
        autoindex_format json;

        limit_except GET {
                auth_jwt_key_request /jwks_uri;
		auth_jwt_require_claim realm_access.roles intersect json=["somlocation-put-right"];
        }
}

is this module capable of being used this way?

[col-panic]

Using it like this fails with

nginx: [emerg] "auth_jwt" directive is not allowed here in /etc/nginx/conf.d/cockpit.conf:32

is this a hard-coded limitation? Is it implemented in open-source nginx like this? Is their commercial
version a patched instance that allows jwt? If yes, why is it documented in the open-source part documentation?

[col-panic]

I raised an issue in nginx nginx/nginx#368 for a more generic solution to limit_except depending on their feedback, there might be a connection to this plugin opening it up via an internal auth_request call.

[kjdev]

document

I wonder if I should add NGX_HTTP_LMT_CONF to Configuration Directives.

NGX_HTTP_LMT_CONF — In a limit_except block within the http block. 

I haven't tested it yet, but it seems to pass the test configuration by adding it.

[col-panic]

Looks promising! It seems that there are no specific reasons for why the other auth types are simply not available within this block?!

[kjdev]

bb676de: add limit_except to the following directive context

• auth_jwt
• auth_jwt_key_file
• auth_jwt_key_request
• auth_jwt_require
• auth_jwt_require_claim
• auth_jwt_require_header
• auth_jwt_revocation_list_kid
• auth_jwt_revocation_list_sub
• auth_jwt_validate_exp
• auth_jwt_validate_sig

[col-panic]

thank you very much - very nice! I will have to wait for it becoming part of the alpine release though to fully roll it out!

[kjdev]

Create a new version and request an update of the alpine package

[col-panic]

I'm sorry @kjdev is this a question or a statement? Can I do this, or help you with it?

[kjdev]

Statement.
I am planning to respond on my end.