Nginx proxy_pass stripping Authorization bearer header: Fix and config syntax

Root Cause Diagnosis

Nginx strips or fails to forward the Authorization header during a proxy_pass request when the header contains non-standard characters, when underscores_in_headers is disabled, or most commonly, when multi-tier proxy/rewrite rules clear header buffers. Additionally, if the downstream application expects lowercase header handling or Nginx is configured to drop unhandled headers during subrequests and auth_request directives, the Authorization header is implicitly omitted.

Quick Fix

Ensure the Authorization header is explicitly passed in your location block using the $http_authorization variable:

proxy_set_header Authorization $http_authorization;
proxy_pass_request_headers on;

Step-by-Step Resolution

1. Open the Nginx Site Configuration

Locate and edit your specific site or location block configuration file (typically in /etc/nginx/sites-available/ or /etc/nginx/conf.d/).

sudo nano /etc/nginx/sites-available/default

2. Configure the Location Block

Add the explicit proxy_set_header directive alongside standard proxy headers inside the relevant location block.

server {
    listen 80;
    server_name api.example.com;

    location /api/ {
        proxy_pass http://127.0.0.1:8080/;

        # Explicitly pass the incoming Bearer token
        proxy_set_header Authorization $http_authorization;

        # Preserve Standard Proxy Headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Ensure original request headers are forwarded
        proxy_pass_request_headers on;
    }
}

3. Handle Underscores in Headers (If Applicable)

If your token or custom auth header uses underscores or non-standard syntax, enable underscores_in_headers at the http or server context.

http {
    underscores_in_headers on;
    ...
}

4. Validate and Reload Nginx

Test the configuration for syntax errors before reloading the daemon.

sudo nginx -t
sudo systemctl reload nginx

Why This Fails for Some Users

Subrequests & auth_request module: When using the ngx_http_auth_request_module, Nginx clears original client request headers for internal subrequests by default. The auth subrequest response headers are not automatically passed back to the backend unless explicitly set using auth_request_set.
Clearing Headers via Proxy Directives: Setting proxy_set_header Authorization ""; anywhere in an inherited upper context (http or server level) will explicitly strip the header unless overridden in the specific location block.
HTTP/2 to HTTP/1.1 Protocol Mismatch: Clients sending headers over HTTP/2 normalize header names to lowercase (authorization). If downstream services strictly enforce case-sensitive matching or Nginx upstream modules rewrite headers during protocol downgrades, header parsing will fail on the backend.
Apache/WSGI Upstream Issues: If Nginx proxies to Apache or Python WSGI servers (e.g., Gunicorn, uWSGI), the backend web server itself may drop Authorization headers before reaching the application code due to default security settings (e.g., Apache’s CGIPassAuth must be set to On).