# SSO like hack using Nextcloud to protect other webapps on nginx

**URL:** <https://help.nextcloud.com/t/sso-like-hack-using-nextcloud-to-protect-other-webapps-on-nginx/54686>\
**Category:** 💻 Development\
**Tags:** sso, app-development\
**Created:** [June 7, 2019, 6:50pm UTC](https://help.nextcloud.com/t/sso-like-hack-using-nextcloud-to-protect-other-webapps-on-nginx/54686 "2019-06-07T18:50:07Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![yvesf](https://help.nextcloud.com/letter_avatar/yvesf/32/6_22734026db12803ebb3e059622ac3534.png) [@yvesf](https://help.nextcloud.com/u/yvesf)\
**Post date:** [June 7, 2019, 6:50pm UTC](https://help.nextcloud.com/t/sso-like-hack-using-nextcloud-to-protect-other-webapps-on-nginx/54686/1 "2019-06-07T18:50:07Z")

</div>

Hi,

I have the situation where nextcloud is installed on a webserver along with other tools:

- path: /nextcloud The Nextcloud instance
- path: /grafana A grafana instance
- path: /media some other stuff

My goal is to protect the other URLs using the login from Nextcloud.

I built a very small nextcloud-app that:

- changes the cookie path to `/`
- provides an GET endpoint checking if the user is authenticated

Then nginx uses `auth_request` against this new endpoint to authorize every request to the other apps (yes this impairs performance a bit).

If you are interested please have a look: [GitHub - yvesf/nextcloud-app-poorsso: \*BROKEN\* in newer nextcloud version. Hook has been removed. Poor men's SSO using nextcloud login](https://github.com/yvesf/nextcloud-app-poorsso) Feedback is welcome.

I’m not experienced with Nextcloud and open for suggestions and especially security hints.

Kind regards, yves