Access assertions
Headers and claims your application must verify for Zero Trust requests.
Loclix removes visitor-supplied X-Loclix-Access-* headers. Authorized origin requests receive:
| Header | Value |
|---|---|
X-Loclix-Access-Jwt-Assertion | RS256-signed JSON Web Token (JWT) |
X-Loclix-Access-Subject | Provider ID and immutable subject |
X-Loclix-Access-Provider | Configured provider ID |
X-Loclix-Access-Email | Verified email, when available |
Trusted configuration
Verify the signed assertion before trusting any identity header. Read identity claims only after verification. Configure the expected issuer and application audience through trusted deployment settings. Never select a key endpoint from unverified token claims.
Issuer: https://APPLICATION-HOST/_loclix/access/
Audience: APPLICATION-ID
Public keys: https://APPLICATION-HOST/_loclix/access/jwks.json
Algorithm: RS256
Lifetime: 60 secondsClaims
The public key endpoint returns a JSON Web Key Set (JWKS), including a kid for key selection.
Assertions contain iss, aud, sub, exp, nbf, iat, jti, application_id, provider, email, email_verified, name, host, method, uri, and origin_uri.
The sub claim uses the same provider-specific format as the subject header.
The uri includes the public escaped path and query string. The origin_uri contains the final origin path after Loclix route rewrites.
Verification
The origin must verify the RS256 signature, configured issuer and audience, expiry, and not-before time.
It must compare the signed host, method, and origin_uri with the expected public hostname and origin request.
If another trusted proxy rewrites requests, preserve the original values through its authenticated connection.
Only use an email claim when email_verified is true. Use the immutable subject as the application account identifier.
Do not log or reflect assertion tokens. They are bearer credentials and can be replayed for the same request during their short lifetime.
Restrict direct origin access with a firewall or authenticated origin pulls to reduce the risk of replay outside Loclix.