Authentication issues behind reverse proxy

  • What Grafana version and what operating system are you using?
    11.1.5 in Kubernetes
  • What are you trying to achieve?
    We enabled jwt authentication and the auth flow works.
    In our case an API gateway injects the authentication token in the header. Now we face the issue that the user login works but, in the developer tools we can see that the websocket authentication does not work.

Error message:
WebSocket connection to ‘wss:///api/live/ws’ failed: HTTP Authentication failed; no valid credentials available

  • How are you trying to achieve it?

We enabled it through grafana.ini and grafana ini looks like this:
[analytics]
check_for_updates = true
[auth]
anonymous = false
disable_login_form = true
disable_signout_menu = true
login_maximum_inactive_lifetime_duration = 30s
login_maximum_lifetime_duration = 1s
oauth_auto_login = false
[auth.anonymous]
enabled = false
[auth.jwt]
auto_sign_up = true
enabled = true
header_name = Authorization
jwk_set_url = “…”
role_attribute_path = “…”
[grafana_net]
url = https://grafana.net
[log]
mode = console
[paths]
data = /var/lib/grafana/
logs = /var/log/grafana
plugins = /var/lib/grafana/plugins
provisioning = /etc/grafana/provisioning
[security]
allow_embedding = true
[server]
domain = ‘’

  • What happened?
    We face an error with the websocket connection:
    Error message:
    WebSocket connection to ‘wss:///api/live/ws’ failed: HTTP Authentication failed; no valid credentials available

The dashboards to not update, be we can get the latest values by reloading the page.

  • What did you expect to happen?
    It just works.

  • Can you copy/paste the configuration(s) that you are having problems with?

  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were.
    I did not find any logs, but I got the error in the frontend dev tools.

  • Did you follow any online instructions? If so, what is the URL?
    Yes, Grafana JWT documentation

That “API gateway” must have proper support for websockets. Are you really sure that’s supported in your case? Not all proxies can transparently proxy WebSocket connections by default.