# User Header Validation

**URL:** <https://forum.rclone.org/t/user-header-validation/53611>\
**Category:** Feature\
**Created:** [March 31, 2026, 3:03pm UTC](https://forum.rclone.org/t/user-header-validation/53611 "2026-03-31T15:03:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hansen-m](https://forum.rclone.org/user_avatar/forum.rclone.org/hansen-m/32/21273_2.png) [@hansen-m](https://forum.rclone.org/u/hansen-m)\
**Post date:** [March 31, 2026, 3:03pm UTC](https://forum.rclone.org/t/user-header-validation/53611/1 "2026-03-31T15:03:40Z")

</div>

The context here is I’m investigating configuring the rclone web GUI within [Open OnDemand](https://www.openondemand.org/), which is a popular open-source multi-user HPC portal that uses a system-wide apache proxy to connect users with their per-user nginx sessions.

For security reasons, recent versions of OnDemand will strip any basic authentication information out before it reaches the nginx sessions, which creates a problem with the current web GUI options. I see a couple of workarounds but both seemingly would require some upstream code additions -

1. Try use the login\_token URL parameter but without basic authentication, but in my testing it appears that the only way to disable basic auth is with the `--rc-no-auth` option, which also unfortunately removes the login\_token as well.

2. Disable basic auth and use the `--rc-user-from-header`option, which would enable checking the "X-Forwarded-User" header value that OnDemand provides but I don’t see a way to validate the value of the header beyond the `validUsernameRegexp` check that happens in the middleware. This would mean any logged in user could access the rclone session started by another user.

With option 2, would it be feasible to add a header value validation check which would ensure the user who started the rclone session is the same user who is accessing it, if not they would get an unauthorized error. Potentially it could check against a string provided by a new option, or a user environment variable, or from the `--rc-user` option.

---

<div class="post-metadata">

**Author:** ![hansen-m](https://forum.rclone.org/user_avatar/forum.rclone.org/hansen-m/32/21273_2.png) [@hansen-m](https://forum.rclone.org/u/hansen-m)\
**Post date:** [April 2, 2026, 1:07pm UTC](https://forum.rclone.org/t/user-header-validation/53611/2 "2026-04-02T13:07:20Z")

</div>

As a basic proof-of-concept I tested this workflow by adding the user match to the regex validation line in `lib/http/middleware.go` and it seemed to work well -

```auto
if username != "" && validUsernameRegexp.MatchString(username) && username == os.Getenv("USER")

```

---

<div class="post-metadata">

**Author:** ![hansen-m](https://forum.rclone.org/user_avatar/forum.rclone.org/hansen-m/32/21273_2.png) [@hansen-m](https://forum.rclone.org/u/hansen-m)\
**Post date:** [April 23, 2026, 1:37am UTC](https://forum.rclone.org/t/user-header-validation/53611/3 "2026-04-23T01:37:23Z")

</div>

Would either of these options be likely considered for a pull request?

---

<div class="post-metadata">

**Author:** ![system](https://forum.rclone.org/uploads/default/original/2X/3/39ad3235f6ffec76ccd0c81616bd55697b4c300d.png) [@system](https://forum.rclone.org/u/system)\
**Post date:** [June 22, 2026, 1:37am UTC](https://forum.rclone.org/t/user-header-validation/53611/4 "2026-06-22T01:37:57Z")

</div>

Closed on June 22, 2026, 1:37am UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.