App to add authentication to the draft version of GOV.UK, so that only users with
a signon account - or a valid JSON web token (JWT) - can access it. See the request flow with draft router.
The app proxies requests to an upstream service. The proxy works by subclassing rack-proxy methods (e.g. call to perform the request)
The app performs authentication using gds-sso to ensure that only authenticated
users are able to view the site. It sets a X-GOVUK-AUTHENTICATED-USER header and a
X_GOVUK_AUTHENTICATED_USER_ORGANISATION header so that the upstream service can identify the user.
It also removes the Host header and replaces it with a X-Forwarded-Host header.
Bypassing authentication with a JSON Web Token (JWT)
The application also supports bypassing authentication via a valid JWT.
The requested URL must contain a valid JWT token as a value for the token query parameter. The JWT must be encoded with the value
in the JWT_AUTH_SECRET environment variable. If the token contains a sub key then the value is passed in the GOVUK_AUTH_BYPASS_ID header.
If a user is authenticated using gds-sso and a JWT is also provided, both
sets of information are passed upstream. It is up to the upstream application how
to handle these cases.
In GOV.UK Docker, GOVUK_UPSTREAM_URI defaults to frontend. This
means that, when you request authenticating-proxy.dev.gov.uk, it should behave
the same as requesting frontend.dev.gov.uk.