github-starred/frp

Fork 0

mirror of https://github.com/fatedier/frp.git synced 2026-05-15 08:05:49 -06:00

[GH-ISSUE #1421] http reverse proxy with NTLM authentication support #1116

New issue

Closed

opened 2026-05-05 12:43:04 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 12:43:04 -06:00

Owner

Originally created by @hez2010 on GitHub (Aug 31, 2019).
Original GitHub issue: https://github.com/fatedier/frp/issues/1421

What version of frp are you using (./frpc -v or ./frps -v)?
0.27.1

What operating system and processor architecture are you using (go env)?
Windows 10 x64 1903 18362.295

Configures you used:
frpc.ini:

[common]
server_addr = xxxx
server_port = 7000

[devops]
type = http
local_port = 80
custom_domains = xxxx.com
host_header_rewrite = xxxx.com

Steps to reproduce the issue:

setup a website using NTLM authentication
setup http proxy with frp
access your service via proxy

Describe the results you received:
cannot authenticate.

Describe the results you expected:
authenticate successfully

Can you point out what caused this issue (optional)
After searching I found the reason:
NTLM won't work if the TCP packets are not forwarded exactly as the reverse proxy received > them. And that's why many reverse proxy doesn't work with NTLM authentication. (like nginx) > They forward HTTP requests correcty but not the TCP packets.

To solve this, you need to create a keepalive agent.

Originally created by @hez2010 on GitHub (Aug 31, 2019). Original GitHub issue: https://github.com/fatedier/frp/issues/1421 **What version of frp are you using (./frpc -v or ./frps -v)?** 0.27.1 **What operating system and processor architecture are you using (`go env`)?** Windows 10 x64 1903 18362.295 **Configures you used:** frpc.ini: ``` [common] server_addr = xxxx server_port = 7000 [devops] type = http local_port = 80 custom_domains = xxxx.com host_header_rewrite = xxxx.com ``` **Steps to reproduce the issue:** 1. setup a website using NTLM authentication 2. setup http proxy with frp 3. access your service via proxy **Describe the results you received:** cannot authenticate. **Describe the results you expected:** authenticate successfully **Can you point out what caused this issue (optional)** After searching I found the [reason](https://stackoverflow.com/questions/4368453/how-to-enable-windows-authentication-through-a-reverse-proxy): NTLM won't work if the TCP packets are not forwarded exactly as the reverse proxy received > them. And that's why many reverse proxy doesn't work with NTLM authentication. (like nginx) > They forward HTTP requests correcty but not the TCP packets. To solve this, you need to create a keepalive agent.

gitea-mirror closed this issue

2026-05-05 12:43:05 -06:00

gitea-mirror commented

2026-05-05 12:43:06 -06:00

Author

Owner

@fatedier commented on GitHub (Sep 1, 2019):

It can't supported now, you can try tcp type instead.

@fatedier commented on GitHub (Sep 1, 2019): It can't supported now, you can try tcp type instead.

gitea-mirror commented

2026-05-05 12:43:07 -06:00

Author

Owner

@hez2010 commented on GitHub (Sep 1, 2019):

Tcp type proxy do can pass the NTLM Authentication, however while using tcp type proxy, all resources in the website will load from wrong locations.
Is there any plan to support NTLM Authentication in http proxy?

@hez2010 commented on GitHub (Sep 1, 2019): Tcp type proxy do can pass the NTLM Authentication, however while using tcp type proxy, all resources in the website will load from wrong locations. Is there any plan to support NTLM Authentication in http proxy?

gitea-mirror commented

2026-05-05 12:43:08 -06:00

Author

Owner

@fatedier commented on GitHub (Sep 1, 2019):

If tcp doesn't work, no other method can help.

@fatedier commented on GitHub (Sep 1, 2019): If tcp doesn't work, no other method can help.

gitea-mirror commented

2026-05-05 12:43:09 -06:00

Author

Owner

@hez2010 commented on GitHub (Sep 2, 2019):

I hope that frp can provide an option to create a keepalive http agent(in frps), then the problem can be solved.

@hez2010 commented on GitHub (Sep 2, 2019): I hope that frp can provide an option to create a keepalive http agent(in frps), then the problem can be solved.

gitea-mirror commented

2026-05-05 12:43:10 -06:00

Author

Owner

@fatedier commented on GitHub (Sep 2, 2019):

It can't supported now, maybe future. It's cpmplicated.
You can try tcp type instead, if it doesn't work, frp is not suitable for you.

@fatedier commented on GitHub (Sep 2, 2019): It can't supported now, maybe future. It's cpmplicated. You can try tcp type instead, if it doesn't work, frp is not suitable for you.