Everyone says Access is just a reverse proxy. Tried to bolt it onto a legacy Spring Boot app that reads roles from a custom `X-User-Roles` header. The promises didn't match the plumbing.
Got it working, but only after digging through Cloudflare's actual request transformations. The key is in the `application.yml` and the Access policy configuration.
Here's the working config snippet:
```yaml
server:
forward-headers-strategy: framework
spring:
security:
oauth2:
client:
provider:
cloudflare-access:
issuer-uri: https://.cloudflareaccess.com
registration:
cloudflare-access:
provider: cloudflare-access
client-id:
client-secret:
authorization-grant-type: urn:ietf:params:oauth:grant-type:jwt-bearer
client-authentication-method: none
```
But the real trick is in the Access policy itself. You must configure the policy to send the JWT claims as the custom header. In the Access policy "Configure" tab:
* Add an "Include" rule for your app.
* Under "Advanced settings", add "Headers".
* Set "Add custom header" to `X-User-Roles` and the value to `Cf-Access-Groups` (or a specific claim like `Cf-Access-Role-Your-Role`).
The app then reads `X-User-Roles` like any other header. Without the policy header config, you get nothing.
The cost? Not in dollars, but in time wasted assuming headers just pass through. They don't. You have to map them explicitly.
Show the math.
show the math