Repository navigation
Fix preaccess phase ngx ok skips limiter - #62
Merged
Merged
Conversation
ngx_http_auth_jwt_http_ok() always returned NGX_OK regardless of phase. nginx's generic phase checker used for PREACCESS advances to the next phase entirely on NGX_OK, so with auth_jwt_phase preaccess a successful request skipped every other PREACCESS handler registered after this module, including limit_req/limit_conn and third-party modules keying on the claim variables this module populates (e.g. nginx-ratelimit on $jwt_claim_sub). Return NGX_DECLINED when phase == NGX_HTTP_PREACCESS_PHASE so the phase continues to the next handler instead, matching the convention used by realip and other variable-populating PREACCESS handlers. Access-phase behavior and failure handling are unchanged.
Add a regression test that runs auth_jwt in preaccess mode with limit_req_zone keyed on $jwt_claim_sub. Two pipelined requests with the same sub over one connection expect 200 then 503, proving limit_req actually executes after this module in the same PREACCESS phase instead of being skipped.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThe JWT module now returns ChangesPREACCESS authentication flow
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant JWTModule
participant NginxPreaccess
participant LimitReq
JWTModule->>NginxPreaccess: Authenticate and resolve $jwt_claim_sub
JWTModule-->>NginxPreaccess: Return NGX_DECLINED
NginxPreaccess->>LimitReq: Continue PREACCESS processing
LimitReq->>LimitReq: Apply request limit by JWT subject
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/DIRECTIVES.md`:
- Around line 186-187: Update the adjacent ACCESS-phase notes in the
documentation block so the blockquote remains continuous: remove the blank line
between the quoted lines or prefix that blank line with `>`, while preserving
the note text.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e7bf1295-9a82-4c7f-b518-91df0391e62e
📒 Files selected for processing (4)
CHANGELOG.mddocs/DIRECTIVES.mdsrc/ngx_http_auth_jwt_module.ct/auth_jwt_phase_limit_req.t
…y gap Explain that auth_jwt_phase preaccess now lets the phase continue after a successful match so limit_req/limit_conn/nginx-ratelimit can key on the resolved claim variables, and note the pre-existing limitation that nginx core's auth_delay does not apply to 401 responses in the PREACCESS phase.
kjdev
force-pushed
the
fix/preaccess-phase-ngx-ok-skips-limiter
branch
from
July 13, 2026 02:49
20702db to
e8eb240
Compare
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
auth_jwt_phasedocumentation to reflect correct PREACCESS continuation, subrequest limitations, andauth_delaybehavior.$jwt_claim_*is populated before rate limiting runs.