Revert "Merge pull request TeslaGov#54 from TeslaGov/pr/42"

This reverts commit f6e8452, reversing
changes made to bf24cbe.

Author: fitzyjoe

README.md

@@ -40,29 +40,13 @@ This module requires several new `nginx.conf` directives,
 which can be specified in on the `main` `server` or `___location` level.
 
 ```
-auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
+auth_jwt_key "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF"; # see docs for format based on algorithm
+auth_jwt_loginurl "https://yourdomain.com/loginpage";
 auth_jwt_enabled on;
 auth_jwt_algorithm HS256; # or RS256
 auth_jwt_validate_email on;  # or off
 ```
 
-So, a typical use would be to specify the key on the main level and then only 
-turn on the locations that you want to secure (not the login page).  Unauthorized 
-requests are given 401 "Unauthorized" responses, you can redirect them with the 
-nginx's `error_page` directive.
-
-```
-___location @login_redirect {
-  allow all;
-  return 302 https://yourdomain.com/loginpage;
-}
-
-___location /secure-___location/ {
-  auth_jwt_enabled   on;
-  error_page  401 = @login_redirect;
-}
-```
-
 The default algorithm is 'HS256', for symmetric key validation.  When using HS256, the value for `auth_jwt_key` should be specified in binhex format.  It is recommended to use at least 256 bits of data (32 pairs of hex characters or 64 characters in total) as in the example above.  Note that using more than 512 bits will not increase the security.  For key guidelines please see NIST Special Publication 800-107 Recommendation for Applications Using Approved Hash Algorithms, Section 5.3.2 The HMAC Key.
 
 The configuration also supports the `auth_jwt_algorithm` 'RS256', for RSA 256-bit public key validation. If using "auth_jwt_algorithm RS256;", then the `auth_jwt_key` field must be set to your public key.
@@ -80,7 +64,15 @@ oQIDAQAB
 -----END PUBLIC KEY-----";
 ```
 
-This module supports two ways of presenting the token.
+A typical use would be to specify the key and loginurl on the main level
+and then only turn on the locations that you want to secure (not the login page).
+Unauthorized requests are given 302 "Moved Temporarily" responses with a ___location of the specified loginurl.
+
+```
+auth_jwt_redirect            off;
+```
+If you prefer to return 401 Unauthorized, you may turn `auth_jwt_redirect` off.
+
 ```
 auth_jwt_validation_type AUTHORIZATION;
 auth_jwt_validation_type COOKIE=rampartjwt;

resources/test-jwt-nginx.conf

@@ -1,38 +1,33 @@
 server {
     auth_jwt_key                 "00112233445566778899AABBCCDDEEFF00112233445566778899AABBCCDDEEFF";
-    set $auth_jwt_login_url      "https://teslagov.com";
+    auth_jwt_loginurl            "https://teslagov.com";
     auth_jwt_enabled             off;
+    auth_jwt_redirect            on;
 
     listen       8000;
     server_name  localhost;
 
-    root  /usr/share/nginx/html;
-    index  index.html index.htm;
-
-    ___location @login_redirect {
-      return 302 $auth_jwt_login_url?redirect=$request_uri&$args;
-    }
-
     ___location ~ ^/secure-no-redirect/ {
-        rewrite "" / break;
         auth_jwt_enabled   on;
+        auth_jwt_redirect  off;
+        root  /usr/share/nginx;
+        index  index.html index.htm;
     }
 
     ___location ~ ^/secure/ {
-        rewrite "" / break;
         auth_jwt_enabled   on;
         auth_jwt_validation_type COOKIE=rampartjwt;
-        error_page  401 = @login_redirect;
+        root  /usr/share/nginx;
+        index  index.html index.htm;
     }
 
     ___location ~ ^/secure-auth-header/ {
-        rewrite "" / break;
         auth_jwt_enabled on;
-        error_page  401 = @login_redirect;
+        root  /usr/share/nginx;
+        index  index.html index.htm;
     }
 
     ___location ~ ^/secure-rs256/ {
-        rewrite "" / break;
         auth_jwt_enabled on;
         auth_jwt_validation_type COOKIE=rampartjwt;
         auth_jwt_algorithm RS256;
@@ -45,7 +40,13 @@ ZQX0miOXXWdkQvWTZFXhmsFCmJLE67oQFSar4hzfAaCulaMD+b3Mcsjlh0yvSq7g
 K49NdYBvFP+hNVEoeZzJz5K/nd6C35IX0t2bN5CVXchUFmaUMYk2iPdhXdsC720t
 BwIDAQAB
 -----END PUBLIC KEY-----";
+        root  /usr/share/nginx;
+        index  index.html index.htm;
     }
 
-    ___location / {}
+    ___location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
 }
+