@@ -239,7 +239,6 @@ The command line to run `oauth2_proxy` in this configuration would look like thi
239239 --client-secret=...
240240```
241241
242−
243242## Endpoint Documentation
244243
245244OAuth2 Proxy responds directly to the following endpoints. All other endpoints will be proxied upstream when authenticated. The `/oauth2` prefix can be changed with the `--proxy-prefix` config variable.
@@ -249,7 +248,7 @@ OAuth2 Proxy responds directly to the following endpoints. All other endpoints w
249248* /oauth2/sign_in - the login page, which also doubles as a sign out page (it clears cookies)
250249* /oauth2/start - a URL that will redirect to start the OAuth cycle
251250* /oauth2/callback - the URL used at the end of the OAuth cycle. The oauth app will be configured with this as the callback url.
252−* /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html)
251+* /oauth2/auth - only returns a 202 Accepted response or a 401 Unauthorized response; for use with the [Nginx `auth_request` directive](#nginx-auth-request)
253252
254253## Logging Format
255254
@@ -266,3 +265,30 @@ Follow the examples in the [`providers` package](providers/) to define a new
266265`Provider` instance. Add a new `case` to
267266[`providers.New()`](providers/providers.go) to allow `oauth2_proxy` to use the
268267new `Provider`.
268+
269+## <a name="nginx-auth-request"></a>Configuring for use with the Nginx `auth_request` directive
270+
271+The [Nginx `auth_request` directive](http://nginx.org/en/docs/http/ngx_http_auth_request_module.html) allows Nginx to authenticate requests via the oauth2_proxy's `/auth` endpoint, which only returns a 202 Accepted response or a 401 Unauthorized response without proxying the request through. For example:
272+
273+```nginx
274+server {
275+ listen 443 ssl spdy;
276+ server_name ...;
277+ include ssl/ssl.conf;
278+
279+ location = /auth {
280+ internal;
281+ proxy_pass http://127.0.0.1:4180;
282+ }
283+
284+ location / {
285+ auth_request /auth;
286+ error_page 401 = ...;
287+
288+ root /path/to/the/site;
289+ default_type text/html;
290+ charset utf-8;
291+ charset_types application/json utf-8;
292+ }
293+}
294+```