Skip to content

Proxy server that signs and authenticates HTTP requests using an HMAC signature


Notifications You must be signed in to change notification settings


Repository files navigation

hmacproxy HMAC authentication proxy server

Proxy server that signs and authenticates HTTP requests using an HMAC signature; uses the Go package.

Build Status

Coverage Status


For now, install from source:

$ go get

Testing out locally

The following will authenticate local requests and return a status of 202 if everything works. Change the values for -secret, -sign-header, and -headers to simulate authentication failures.

In the first shell:

$ hmacproxy -port 8081 -secret "foobar" -sign-header "X-Signature" -auth responding Accepted/Unauthorized for auth queries

In the second shell:

$ hmacproxy -port 8080 -secret "foobar" -sign-header "X-Signature" \
  -upstream http://localhost:8081/ proxying signed requests to: http://localhost:8081/

In the third shell:

$ curl -i localhost:8080/mbland/hmacproxy

HTTP/1.1 202 Accepted
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Date: Mon, 05 Oct 2015 15:32:56 GMT

Signing outgoing requests

$ hmacproxy -port 8080 -secret "foobar" -sign-header "X-Signature" \

Validating incoming requests

All of the following require the -auth flag.

Proxying to an upstream server

$ hmacproxy -port 8080 -secret "foobar" -sign-header "X-Signature" \
  -upstream -auth

Serving files directly

$ hmacproxy -port 8080 -secret "foobar" -sign-header "X-Signature" \
  -file-root /path/to/my/files -auth

Returning an Accepted/Unauthorized status

This should be compatible with the Nginx ngx_http_auth_request_module by using an auth_request directive to proxy to the hmacproxy.

$ hmacproxy -port 8080 -secret "foobar" -sign-header "X-Signature" -auth

Then add configuration such as the following to your nginx instance, where:

  • PORT is replaced with the port number of your service
  • is replaced with the virtual server name for your service
  • ssl/ contains the SSL configuration for your server.
  • matches the address of the local hmacproxy instance from above
  • The X-Original-URI header is added to the authentication request, defined using the builtin $request_uri nginx variable.
server {
  listen PORT ssl spdy;

  include ssl/;

  location = /auth {
    proxy_set_header X-Original-URI $request_uri;

  location / {
    auth_request /auth;

Accepting incoming requests over SSL

If you wish to expose the proxy endpoints directly to the public, rather than via an Nginx proxy scheme, pass the -ssl-cert and -ssl-key options along all other -auth parameters.


Proxy server that signs and authenticates HTTP requests using an HMAC signature







No packages published