Traefik Cloudflare Access Validator

This is a simple Traefik middleware plugin that validates Cloudflare Access JWT tokens. See the Cloudflare Access documentation for more information.

Configuration

The middleware can be configured with the following options:

Setting	Type	Required	Description
team_domain	string	yes	Cloudflare Access team domain name
policy_aud	string	yes	Application Audience Tag docs

Enable the plugin

To enable the plugin, add the following to your Traefik configuration:

experimental:
  plugins:
    cloudflare-access-validator:
      moduleName: .github.com/Cyb3r-Jak3/traefik-cloudflare-jwt
      version: v0.1.1

Plugin configuration

To configure the plugin, add the following to your Traefik configuration:

http:
  middlewares:
    cloudflare-access-validator:
      plugin:
        cloudflare-access-validator:
            team_domain: example
            policy_aud: 1234567890

  routers:
    my-router:
      rule: Path(`/whoami`)
      service: service-whoami
      entryPoints:
        - http
      middlewares:
        - cloudflare-access-validator

  services:
    service-whoami:
      loadBalancer:
        servers:
          - url: http://127.0.0.1:5000

Testing

There are basic tests for making sure missing or invalid tokens are rejected. Due to the dependence on external services, I am unable to test a valid header with unit tests.

If you would like to contribute, please feel free to open a PR.