Missing Authorization header with ForwardAuth in Traefik - traefik

Question

I have following traefik setup:
mybackend - golang backend
myauth - dedicated auth backend validating jwt token.
all run with traefik.
I want all requests first pass through myauth backend to validate jwt token / rate limit users before reaching mybackend.
When using this configuration myauth doesn't receive Authorization header containing authorization jwt token.
When I don't use forwardauth middleware Authorization header is there.
Here is the traefik configuration file I have:
version: '3'
services:
reverse-proxy:
image: traefik:v2.0
restart: always
command:
- "--api=true"
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.http.address=:80"
- "--entrypoints.https.address=:443"
- "--certificatesresolvers.mydnschallenge.acme.dnschallenge=true"
- "--certificatesresolvers.mydnschallenge.acme.dnschallenge.provider=digitalocean"
- "--certificatesresolvers.mydnschallenge.acme.email=support#mydomain.com"
- "--certificatesresolvers.mydnschallenge.acme.storage=/acme.json"
environment:
- DO_AUTH_TOKEN=${DO_AUTH_TOKEN}
ports:
- "80:80"
- "443:443"
- "6969:8080"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ../acme/acme.json:/acme.json
mybackend:
image: mybackend
restart: always
depends_on:
- mongo
labels:
- "traefik.enable=true"
# creates new middleware called redirect-to-https
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
# creates new router called redirect-https
- "traefik.http.routers.redirect-https.rule=Host(`api.mydomain.com`)"
- "traefik.http.routers.redirect-https.entryPoints=http"
# applies middleware to router
- "traefik.http.routers.redirect-https.middlewares=redirect-to-https"
# creates new router called api_tls
- "traefik.http.routers.api.entryPoints=https"
- "traefik.http.routers.api.tls.certresolver=mydnschallenge"
- "traefik.http.routers.api.rule=Host(`api.mydomain.com`)"
- "traefik.http.services.api.loadbalancer.server.port=8080"
- "traefik.http.routers.api.middlewares=ratelimitme"
- "traefik.http.middlewares.ratelimitme.forwardauth.address=http://myauth:8080"
- "traefik.http.middlewares.ratelimitme.forwardauth.trustforwardheader=true"
- "traefik.http.middlewares.ratelimitme.forwardauth.authresponseheaders=X-Forwarded-User"
myauth:
image: myauth
deploy:
labels:
- "traefik.enable=true"
- "traefik.http.routers.rate_limiting.entrypoints=http"
- "traefik.http.services.rate_limiting.loadbalancer.server.port=8080"
I tried setting new middleware to set custom headers like this:
- "traefik.http.middlewares.frontend1.headers.customresponseheaders.Access-Control-Allow-Methods=POST, GET, PUT, OPTIONS, DELETE"
- "traefik.http.middlewares.frontend1.headers.customresponseheaders.Access-Control-Allow-Origin=*"
- "traefik.http.middlewares.frontend1.headers.customresponseheaders.Access-Control-Allow-Headers=x-requested-with, Content-Type,Authorization"
but it didn't help.
Thanks for any tips / advices.

Answer 1

Add "Authorization" to the authRequestHeader. For example (using kubernetes):
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: api-auth
namespace: kube-system
spec:
forwardAuth:
address: http://api-auth.default.svc/auth/v1/validate
authRequestHeaders:
- "Authorization"
authResponseHeaders:
- "X-Auth-ID"
---