🔑 feat: allow the session JWT to be read from a configurable header

.env.example

@@ -693,6 +693,11 @@ REFRESH_TOKEN_EXPIRY=(1000 * 60 * 60 * 24) * 7
 JWT_SECRET=
 JWT_REFRESH_SECRET=
 
+# Optional: read the session JWT from this header before falling back to Authorization.
+# Only needed behind a proxy that overwrites Authorization with its own token
+# (e.g. oauth2-proxy with --set-authorization-header). Leave unset otherwise.
+# JWT_AUTH_HEADER=x-original-authorization
+
 # Discord
 DISCORD_CLIENT_ID=
 DISCORD_CLIENT_SECRET=

api/strategies/jwtStrategy.js

@@ -3,11 +3,26 @@ const { SystemRoles } = require('librechat-data-provider');
 const { Strategy: JwtStrategy, ExtractJwt } = require('passport-jwt');
 const { getUserById, updateUser } = require('~/models');
 
+/**
+ * A proxy in front of LibreChat may write the Authorization header itself (oauth2-proxy
+ * with --set-authorization-header, meshes and gateways doing credential injection), in
+ * which case the session token never arrives. JWT_AUTH_HEADER names a header to try
+ * first, holding the raw token with no scheme prefix. Unset, nothing changes.
+ */
+const jwtExtractor = () => {
+  const extractors = [];
+  if (process.env.JWT_AUTH_HEADER) {
+    extractors.push(ExtractJwt.fromHeader(process.env.JWT_AUTH_HEADER));
+  }
+  extractors.push(ExtractJwt.fromAuthHeaderAsBearerToken());
+  return extractors.length > 1 ? ExtractJwt.fromExtractors(extractors) : extractors[0];
+};
+
 // JWT strategy
 const jwtLogin = () =>
   new JwtStrategy(
     {
-      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      jwtFromRequest: jwtExtractor(),
       secretOrKey: process.env.JWT_SECRET,
     },
     async (payload, done) => {

api/strategies/jwtStrategy.spec.js

@@ -1,13 +1,17 @@
 const { SystemRoles } = require('librechat-data-provider');
 
 let capturedVerifyCallback;
+let capturedStrategyOptions;
 jest.mock('passport-jwt', () => ({
   Strategy: jest.fn((opts, verifyCallback) => {
+    capturedStrategyOptions = opts;
     capturedVerifyCallback = verifyCallback;
     return { name: 'jwt' };
   }),
   ExtractJwt: {
     fromAuthHeaderAsBearerToken: jest.fn(() => 'mock-extractor'),
+    fromHeader: jest.fn((name) => `mock-header-extractor:${name}`),
+    fromExtractors: jest.fn((extractors) => extractors),
   },
 }));
 
@@ -73,3 +77,36 @@ describe('jwtStrategy', () => {
     expect(user).toBe(false);
   });
 });
+
+describe('jwtStrategy token extraction', () => {
+  const originalHeader = process.env.JWT_AUTH_HEADER;
+
+  afterEach(() => {
+    if (originalHeader === undefined) {
+      delete process.env.JWT_AUTH_HEADER;
+    } else {
+      process.env.JWT_AUTH_HEADER = originalHeader;
+    }
+  });
+
+  it('reads the Authorization header when JWT_AUTH_HEADER is unset', () => {
+    delete process.env.JWT_AUTH_HEADER;
+    jwtLogin();
+    expect(capturedStrategyOptions.jwtFromRequest).toBe('mock-extractor');
+  });
+
+  it('ignores an empty JWT_AUTH_HEADER', () => {
+    process.env.JWT_AUTH_HEADER = '';
+    jwtLogin();
+    expect(capturedStrategyOptions.jwtFromRequest).toBe('mock-extractor');
+  });
+
+  it('prefers JWT_AUTH_HEADER and keeps Authorization as the fallback', () => {
+    process.env.JWT_AUTH_HEADER = 'x-original-authorization';
+    jwtLogin();
+    expect(capturedStrategyOptions.jwtFromRequest).toEqual([
+      'mock-header-extractor:x-original-authorization',
+      'mock-extractor',
+    ]);
+  });
+});