如何在Nginx rewrite中传递upstream_http_x_auth_request_email作为URL查询参数

我通过OAuth2-Proxy与Nginx实现请求认证，现有Nginx配置如下：

server {
  listen 443 ssl;
  server_name ...;
  include ssl/ssl.conf;

  location /oauth2/ {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    # or, if you are handling multiple domains:
    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
  }
  location = /oauth2/auth {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }

  location / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    proxy_pass http://backend:port;
  }

  location = / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    proxy_pass http://backend:port;
    rewrite ^ /login?email=$email redirect;
  }
}

需求是：仅当请求路径为/时，将登录用户的Email通过rewrite传递到URL的查询参数中。目前访问日志能获取到$email的值，但rewrite后URL中的email参数为空。

OAuth2-Proxy已开启以下配置：

pass_user_header=true
pass_basic_auth=true
set_xauthrequest=true
set_authorization_header=true

尝试过用$upstream_http_x_auth_request_email、$http_x_email替换rewrite中的$email，也试过set $my_email $email;和map $email $my_email { default $email; "" $http_x_email; }，均未解决问题。仅需处理根路径的请求，其余请求沿用默认location逻辑。

核心问题是**auth_request_set定义的变量在rewrite指令中无法直接生效**——auth_request是异步子请求，rewrite的执行时机早于子请求的变量赋值，导致跳转时变量为空。以下是两种可行的解决方法：

方法一：利用内部重定向延迟变量使用 #

通过error_page触发内部重定向，确保变量在auth_request完成后再被使用：

location = / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # 捕获OAuth2-Proxy返回的Email变量
    auth_request_set $auth_email $upstream_http_x_auth_request_email;
    
    # 当auth_request成功返回200时，触发内部重定向到临时location
    error_page 200 = @redirect_login;
}

# 临时location处理跳转逻辑
location @redirect_login {
    rewrite ^ /login?email=$auth_email redirect;
}

方法二：调整rewrite的执行时机 #

通过添加?清除原有查询参数，并确保变量在赋值后被使用：

location = / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    auth_request_set $auth_email $upstream_http_x_auth_request_email;
    
    # 延迟rewrite执行，确保变量已被赋值
    rewrite ^ /login?email=$auth_email? redirect;
    # 末尾的?会清除URL原有查询参数，仅保留我们设置的email参数
}

额外注意事项 #

• 必须确保OAuth2-Proxy的set_xauthrequest=true配置已开启，这是Nginx能获取到X-Auth-Request-Email响应头的前提；
• 确认Nginx版本≥1.11.0，该版本才支持auth_request_set指令；
• 可以删除根路径location中冗余的proxy_pass和其他无关配置，只保留认证和变量捕获逻辑。

内容的提问来源于stack exchange，提问作者Prince Jaiswal