[FEATURE] Pass JWT in Authorization header #963

Activity

1. Sleuth56

   assigned

   steveiliop56

   on Jul 2, 2026
2. Sleuth56

   added

   enhancementNew feature or requestNew feature or request

   on Jul 2, 2026
3. bsaurusrex commented on Oct 9, 2026

   

   bsaurusrex

   on Oct 9, 2026

   More actions

   For context, a few related threads:

   • [FEATURE] conditional Authorization header passthrough to upstream service #858 asked for a similar Bearer passthrough to the upstream app and was closed as out of scope.
   • fix: stop forwarding client Authorization header to downstream apps #1042 confirmed that tinyauth forwards the client's Authorization header as-is. feat: support x-tinyauth-authorization header for basic authentication #1126 (open) adds X-Tinyauth-Authorization so tinyauth's Basic credentials and an app's own Bearer token don't compete for the same header.

   From the current code (main @ 8d99068): the OAuth token is only held in the pending-login cache (GetOAuthToken in internal/service/auth_service.go) and isn't kept after login. The stored Session has no token field. So this would need:

   1. Token storage in the session (sqlite + postgres migration).
   2. Refresh handling, because IdP tokens usually expire long before a tinyauth session does.
   3. A choice of which token to send. Google's access token is opaque and only its id_token is a JWT, while GitHub provides no id_token at all.
   4. A precedence rule with the existing per-app Basic Auth Authorization header in setHeaders.

   Would a scoped, opt-in version (per app, OIDC providers only, id_token only) be something you'd consider, or is this out of scope like #858?

   Disclosure: the code references above were gathered with AI assistance and checked by me.