From 865032a4c56b3980d3d8bc248c061f9828d40d23 Mon Sep 17 00:00:00 2001 From: miloschwartz Date: Wed, 21 Oct 2026 09:29:30 -0400 Subject: [PATCH] add remote headers for private http --- .../docs/manage/access-control/forwarded-headers.mdx | 12 +++++++++--- .../docs/manage/resources/private/private-http.mdx | 2 ++ 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/content/docs/manage/access-control/forwarded-headers.mdx b/content/docs/manage/access-control/forwarded-headers.mdx index 082cd16..0fcbeaa 100644 --- a/content/docs/manage/access-control/forwarded-headers.mdx +++ b/content/docs/manage/access-control/forwarded-headers.mdx @@ -2,10 +2,10 @@ title: "Forwarded Headers" description: "Learn how Pangolin forwards user identity information to your backend applications through HTTP headers" --- -Pangolin can forward user identity information to your backend applications through custom HTTP headers. This allows your applications to receive user details directly from the request headers, enabling integration with Pangolin's authentication system. [AI Gateway](/manage/ai/overview) resources send the same headers to the upstream provider when the caller is a known user. See [Identity Headers](/manage/ai/providers/configuration#identity-headers). +Pangolin can forward user identity information to your backend applications through custom HTTP headers. This allows your applications to receive user details directly from the request headers, enabling integration with Pangolin's authentication system. The same headers apply to [public HTTP/HTTPS resources](/manage/resources/public/http-https), [private HTTP/HTTPS resources](/manage/resources/private/private-http), and [AI Gateway](/manage/ai/overview) resources. For AI Gateway specifics, see [Identity Headers](/manage/ai/providers/configuration#identity-headers). -Forwarded headers are only available when using authentication methods that provide user identity information. +Forwarded headers are only sent when Pangolin knows who the caller is — for example an authenticated public-resource session, or a connected [Pangolin client](/manage/clients/platforms) on a private HTTP resource that maps to a user. ## Supported Headers @@ -19,7 +19,9 @@ Pangolin forwards the following headers to your backend when user identity is av | `Remote-Name` | User's full name | `John Doe` | | `Remote-Role` | User's role or group membership | `admin` | -## Authentication Methods +## Public Resources + +On [public HTTP/HTTPS resources](/manage/resources/public/http-https), headers depend on the authentication method. ### Headers Available @@ -53,6 +55,10 @@ These authentication methods do not provide user identity information: +## Private HTTP + +On [private HTTP/HTTPS resources](/manage/resources/private/private-http), identity comes from the connected [Pangolin client](/manage/clients/platforms), not from a public login page. When that client maps to a user, Pangolin forwards the same `Remote-User`, `Remote-Email`, `Remote-Name`, and `Remote-Role` headers to the upstream app. Access still comes from [private resource grants](/manage/resources/private/authentication) (users, roles, and machines); the headers carry the identity once the client is already authorized. + ## Client Certificate (mTLS) When [mTLS](/manage/access-control/mtls) is enabled on a public resource, verified client certificate details are forwarded in `X-Forwarded-Tls-Client-Cert-Info` (subject, issuer, serial number, validity, and SANs). That header is independent of the `Remote-*` identity headers above and is available whenever the TLS handshake succeeds with a trusted client certificate. diff --git a/content/docs/manage/resources/private/private-http.mdx b/content/docs/manage/resources/private/private-http.mdx index a48de3c..e31d525 100644 --- a/content/docs/manage/resources/private/private-http.mdx +++ b/content/docs/manage/resources/private/private-http.mdx @@ -50,3 +50,5 @@ You can approximate private browsing with a standard private resource by pairing A [public resource](/manage/resources/public/authentication) is reachable from the internet; Pangolin sits in front with authentication (for example platform SSO or other methods) so unauthenticated requests are blocked at the edge—the “bouncer” in front of a public site. Private HTTP does not use that public forward-auth model for reachability. The hostname does not grant access from the open internet at all. The user must connect with the Pangolin client first, like a VPN, before the domain resolves and the reverse proxy will serve the app. Instead of a login page at the edge, Pangolin uses the user's active client connection to determine their identity and enforces [private resource access rules](/manage/resources/private/authentication) (users, roles, machines) from that session. The network path is client-attached only. + +When the connected client maps to a user, Pangolin forwards that identity to the upstream app as `Remote-User`, `Remote-Email`, `Remote-Name`, and `Remote-Role` — the same [forwarded headers](/manage/access-control/forwarded-headers) public resources use.