Proxy Setup

Proxy setup

In production environments, all requests from the frontend to the Algebrakit web service must be routed through your platform's proxy. The proxy is responsible for:

• Authenticating the request to confirm it originates from a valid user
• Attaching the API key
• Forwarding the request to Algebrakit

The proxy must support GET, POST, and DELETE requests and use a fixed IP address. To have your IP address allowlisted, send it to info@algebrakit.nl.

Refer to one of the SDKs for an example of how to configure the proxy.

Example: Routing requests through your backend proxy

AlgebraKIT = {
  config: {
    proxy: {
      url: 'proxy/algebrakit',
      headers: {
        'X-CSRF-Token': 'my-value'
      }
    }
  }
};

Common pitfalls

A misconfigured proxy can cause requests to fail in ways that are hard to diagnose. Watch out for the following:

• DNS resolution caching. Some proxies (notably nginx) cache the resolved IP address of the Algebrakit endpoint for the lifetime of the worker process. When Algebrakit's IP changes during a release, cached requests start failing. Configure the proxy to honor DNS TTLs — for nginx, use the resolver directive together with a variable in proxy_pass.
• Body size limits. Exercise sessions and grading payloads can be large, especially when they include images which can be up to 50Mb each. Default body size limits (often 1 MB) can cause requests to fail with 413 Payload Too Large. Raise the limit (e.g. nginx client_max_body_size, Apache LimitRequestBody).
• Header stripping. Some proxies strip or rewrite headers they do not recognize. Make sure the API key header added by the proxy, as well as Content-Type and Accept, are forwarded to Algebrakit unchanged.
• Response caching. Algebrakit responses contain session-specific data and must not be cached. Verify that any caching layer (reverse proxy, CDN) is disabled for the Algebrakit route.
• TLS version. Algebrakit only supports modern TLS versions. Older proxies that default to TLS 1.0 or 1.1, or that omit SNI when calling upstream, will fail to connect. Ensure the proxy uses TLS 1.2 or higher.