[GH-ISSUE #3221] [Feature Request] Pass client certificate subject information to plugin handler

gitea-mirror commented

2026-05-05 13:39:42 -06:00

Owner

Originally created by @CrazyPandar on GitHub (Dec 20, 2022).
Original GitHub issue: https://github.com/fatedier/frp/issues/3221

Describe the feature request

With TLS client authentication, I hope the subject information, like CN, SUBJECT_ID, can be sent to the plugin handler. So I can do authentication and authorization based on the subject information.

Describe alternatives you've considered

No response

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @CrazyPandar on GitHub (Dec 20, 2022). Original GitHub issue: https://github.com/fatedier/frp/issues/3221 ### Describe the feature request With TLS client authentication, I hope the subject information, like CN, SUBJECT_ID, can be sent to the plugin handler. So I can do authentication and authorization based on the subject information. ### Describe alternatives you've considered _No response_ ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [X] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [X] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror

2026-05-05 13:39:42 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 13:39:46 -06:00

Author

Owner

@fatedier commented on GitHub (Dec 20, 2022):

You should describe the details about what you want to change.

@fatedier commented on GitHub (Dec 20, 2022): You should describe the details about what you want to change.

gitea-mirror commented

2026-05-05 13:39:47 -06:00

Author

Owner

@CrazyPandar commented on GitHub (Dec 20, 2022):

change the plugin HTTP request body to include FRP client's TLS peer certificate information, for example the "common name", "subject ID" ....

@CrazyPandar commented on GitHub (Dec 20, 2022): change the plugin HTTP request body to include FRP client's TLS peer certificate information, for example the "common name", "subject ID" ....

gitea-mirror commented

2026-05-05 13:39:47 -06:00

Author

Owner

@CrazyPandar commented on GitHub (Dec 20, 2022):

please have a look at the following example, the plugin can get the remote FRPC peer's TLS common name by content.user.cert.subject.cname and use it to do authorization.

{
    "content": {
        "user": {
            "user": <string>,
            "metas": map<string>string,
            "run_id": <string>,
            "cert": {
                "subject": {
                    cname: <string>,
                    ........
                }
            }
        },
        "proxy_name": <string>,
        "proxy_type": <string>,
        "use_encryption": <bool>,
        "use_compression": <bool>,
        "group": <string>,
        "group_key": <string>,

        // tcp and udp only
        "remote_port": <int>,

        // http and https only
        "custom_domains": []<string>,
        "subdomain": <string>,
        "locations": <string>,
        "http_user": <string>,
        "http_pwd": <string>,
        "host_header_rewrite": <string>,
        "headers": map<string>string,

        // stcp only
        "sk": <string>,

        // tcpmux only
        "multiplexer": <string>

        "metas": map<string>string
    }
}

@CrazyPandar commented on GitHub (Dec 20, 2022): please have a look at the following example, the plugin can get the remote FRPC peer's TLS common name by content.user.cert.subject.cname and use it to do authorization. ``` { "content": { "user": { "user": <string>, "metas": map<string>string, "run_id": <string>, "cert": { "subject": { cname: <string>, ........ } } }, "proxy_name": <string>, "proxy_type": <string>, "use_encryption": <bool>, "use_compression": <bool>, "group": <string>, "group_key": <string>, // tcp and udp only "remote_port": <int>, // http and https only "custom_domains": []<string>, "subdomain": <string>, "locations": <string>, "http_user": <string>, "http_pwd": <string>, "host_header_rewrite": <string>, "headers": map<string>string, // stcp only "sk": <string>, // tcpmux only "multiplexer": <string> "metas": map<string>string } } ```

gitea-mirror commented

2026-05-05 13:39:48 -06:00

Author

Owner

@fatedier commented on GitHub (Dec 20, 2022):

It's the connection level info, not the meta info of user.

I don't want to make more changes on current version. Maybe considered in v2.

@fatedier commented on GitHub (Dec 20, 2022): It's the connection level info, not the meta info of `user`. I don't want to make more changes on current version. Maybe considered in v2.

gitea-mirror commented

2026-05-05 13:39:49 -06:00

Author

Owner

@github-actions[bot] commented on GitHub (Jan 20, 2023):

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (Jan 20, 2023): Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.