Backend trust tokens

How it works

Turn it on per pool. nginx then puts a shared secret on every request it proxies there:

proxy_set_header X-Fleet-Token "k7Rm...9wQ2";
proxy_hide_header X-Fleet-Token;

Your backend checks the header and returns 403 to anything else. The GUI gives you the snippet for nginx, Apache, Express, Django or Spring, so it is a paste rather than a project.

Three details that matter

• The header is set, not added. A client sending that header itself has it thrown away and replaced. You cannot forge your way in from outside.
• The health checker sends it too. Without that, the moment a backend started enforcing the token, every check would come back 403 and a perfectly healthy pool would be marked down and pulled out of service.
• The secret is stored encrypted and only shown when you ask for it.

What it is and is not

Rotating without an outage

You cannot change both ends at the same instant, and nginx can only send one value, so it takes two steps.

1. Rotate. A new token is generated but nginx keeps sending the old one, so nothing changes on the wire. Add the new one to your backends so they accept either.
2. Activate. nginx starts sending the new one, which your backends already take. Apply the config, watch traffic, then delete the old one from your backends.

Doing it in one step means every request in the gap gets a 403. Turning the feature off is the same idea in reverse: apply the config that stops sending the header first, then stop checking for it.

When to use something else

If you can put the backends on a network only the load balancers can reach, do that instead and skip this entirely. A token is for the case where you cannot, which in practice is most shared or cloud networks.

Common questions