kong-upstream-jwt

A plugin for Kong which adds a signed JWT to HTTP Headers of outgoing requests

$ luarocks install kong-upstream-jwt

API Providers require a means of cryptographically validating that requests they receive were: A. proxied by Kong, and B. not tampered with during transmission from Kong -> API Provider. This token accomplishes both as follows:

1. **Authentication** & **Authorization** - Provided by means of JWT signature validation. The API Provider will validate the signature on the JWT token (which is generating using Kong's RSA x509 private key), using Kong's public key. This public key can be maintained in a keystore, or sent with the token - provided API providers validate the signature chain against their truststore.
2. **Non-Repudiation** - SHA256 is used to hash the body of the HTTP Request Body, and the resulting digest is included in the `payloadhash` element of the JWT body. API Providers will take the SHA256 hash of the HTTP Request Body, and compare the digest to that found in the JWT. If they are identical, the request remained intact during transmission.

Versions

1.4-01 year ago2,946 downloads
1.3-01 year ago(revision: 2)1,003 downloads
1.2-14 years ago(revision: 3)7,658 downloads
1.1-14 years ago(revision: 3)342 downloads
1.0-14 years ago307 downloads
0.7-05 years ago2,472 downloads
0.6-05 years ago577 downloads
0.5-45 years ago1,383 downloads
0.4-46 years ago924 downloads
0.3-76 years ago270 downloads
0.3-66 years ago330 downloads
0.3-56 years ago47 downloads
0.3-46 years ago63 downloads
0.3-36 years ago41 downloads
0.3-26 years ago38 downloads
0.3-16 years ago169 downloads
0.2-16 years ago59 downloads
0.1-16 years ago39 downloads

Manifests