Is there a flag to detect if the request came from a client after doing mtls?

[ishan (Ishan Jain)]

Hi, This is more of a discussion question.

Previously I was using mtls but mtls is not supported everywhere so I switched to Authelia. Now, I have the Authelia page in front of every thing and it’s not transparent like mtls. I am trying to figure out if in Caddy it’s possible to detect whether a request is coming from a client that did mtls authentication ?

If this is possible, Then I can selectively bypass Authelia and use mtls where ever possible and Authelia if mtls was not used.

[ishan (Ishan Jain)]

I think http.request.tls may help here. I don’t know if these fields will contain the details from the outer mtls auth or the internal normal tls auth

I will test this in a few hours

Modules - Caddy Documentation

Client authentication matcher

I was thinking about it since I saw it a few days ago. I think I have a working solution using the vars_regexp matcher. Can you make use of this? example.com { tls { client_auth { mode verify_if_given trust_pool file root.pem } } # ensure at least 1 character is present in fingerprint to indicate mTLS # was provided, hence sucessful if reached this far. @authed vars_regexp {http.request.tls.client.fingerprint} ^([0-9a-zA-Z]{1,}) @notauthed not vars_regexp {http.request.tls.cli…