We are developing a custom Grafana datasource plugin with backend using grafana-plugin-sdk-go (v0.292.1) that uses Grafana Live Streaming.
Our environment is behind an Auth Proxy that injects a corporate authentication token as an HttpOnly cookie.
When a user opens a dashboard, our backend plugin needs to obtain this token to authorize connection to an external streaming PublicAPI.
Since the cookie is HttpOnly, the frontend React code cannot access it.
Inside SubscribeStream and RunStream, the ctx metadata is stripped of cookies, and req.PluginContext.User doesn’t contain any proxy headers.
What is the recommended/idiomatic way to forward a secure HttpOnly cookie or a long auth token from an upstream Auth Proxy down to a backend plugin’s StreamHandler (SubscribeStream or RunStream)?
Are there any native Grafana mechanisms to cache specific proxy headers in the WebSocket session context?
This isn’t supported natively. SubscribeStream/RunStream do not receive the original HTTP request, so HttpOnly cookies and Auth Proxy headers are not forwarded or cached in the WebSocket session.
There is no native Grafana mechanism to forward or cache arbitrary proxy headers for backend stream handlers. Grafana documents forwarded cookies/headers for request-based handlers such as QueryData, CallResource, and CheckHealth, but does not document support for forwarding them to streaming handlers.
One possible approach is to capture the token during a request-based handler where forwarded headers/cookies are available (such as QueryData or CallResource), store it server-side using your own session/user mapping, and retrieve it from RunStream.
If you’re running a Grafana version that includes PR #101960, SubscribeStreamRequest also exposes req.Headers during subscription, so it’s worth checking whether your required headers are available there.
If the stream is user-specific, use per-user channel paths or another mechanism to isolate user state in RunStream.
See the official docs: