Traefik中使用ForwardAuth时Authorization请求头丢失问题

核心问题 #

Traefik的ForwardAuth中间件默认不会将Authorization这类敏感请求头转发给认证服务，必须显式配置要传递的请求头列表。你之前添加的CORS响应头中间件和该问题无关——CORS处理的是跨域请求的响应规则，不影响请求头的转发逻辑。

解决方案 #

1. 显式配置ForwardAuth传递请求头

在mybackend的标签中，给ratelimitme中间件添加authRequestHeaders配置，指定要传递的Authorization头：

- "traefik.http.middlewares.ratelimitme.forwardauth.authRequestHeaders=Authorization"

2. 优化myauth服务配置

myauth作为内部认证服务，不需要通过Traefik对外暴露路由，可直接通过容器网络访问，因此去掉其deploy下的Traefik标签，简化后如下：

myauth:
  image: myauth
  restart: always

修改后的完整mybackend标签配置 #

mybackend:
  image: mybackend
  restart: always
  depends_on:
    - mongo
  labels:
    - "traefik.enable=true"
    # HTTP重定向到HTTPS
    - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
    - "traefik.http.routers.redirect-https.rule=Host(`api.mydomain.com`)"
    - "traefik.http.routers.redirect-https.entryPoints=http"
    - "traefik.http.routers.redirect-https.middlewares=redirect-to-https"
    # HTTPS路由配置
    - "traefik.http.routers.api.entryPoints=https"
    - "traefik.http.routers.api.tls.certresolver=mydnschallenge"
    - "traefik.http.routers.api.rule=Host(`api.mydomain.com`)"
    - "traefik.http.services.api.loadbalancer.server.port=8080"
    # 应用认证限流中间件
    - "traefik.http.routers.api.middlewares=ratelimitme"
    # ForwardAuth配置（新增authRequestHeaders传递Authorization头）
    - "traefik.http.middlewares.ratelimitme.forwardauth.address=http://myauth:8080"
    - "traefik.http.middlewares.ratelimitme.forwardauth.trustforwardheader=true"
    - "traefik.http.middlewares.ratelimitme.forwardauth.authresponseheaders=X-Forwarded-User"
    - "traefik.http.middlewares.ratelimitme.forwardauth.authRequestHeaders=Authorization"

验证方法 #

重启Traefik及相关服务后，发送带Authorization头的请求到api.mydomain.com，查看myauth的服务日志，确认是否接收到该请求头。

内容的提问来源于stack exchange，提问作者basilboli