> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/TecharoHq/Anubis/llms.txt
> Use this file to discover all available pages before exploring further.

# Web Framework Integrations

> Configure Anubis to work with popular web frameworks

# Web Framework Integrations

Anubis works as a reverse proxy in front of your application. This guide covers framework-specific configurations to ensure smooth integration.

## WordPress

WordPress is the most popular blog engine on the planet.

### Multi-site Setup with TLS Termination

If you have a multi-site setup where traffic goes through Anubis like this:

```mermaid theme={null}
---
title: Apache as TLS terminator and HTTP router
---

flowchart LR
    T(User Traffic)
    subgraph Apache 2
        TCP(TCP 80/443)
        US(TCP 3001)
    end

    An(Anubis)
    B(Backend)

    T --> |TLS termination| TCP
    TCP --> |Traffic filtering| An
    An --> |Happy traffic| US
    US --> |whatever you're doing| B
```

WordPress may not realize that the underlying connection is being done over HTTPS. This could lead to a redirect loop in the `/wp-admin/` routes.

**Solution**: Add the following to your `wp-config.php` file:

```php theme={null}
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
    $_SERVER['HTTPS'] = 'on';
    $_SERVER['SERVER_PORT'] = 443;
}
```

This makes WordPress think that your connection is over HTTPS instead of plain HTTP.

## HTMX

[HTMX](https://htmx.org) is a framework that enables you to write applications using hypertext as the engine of application state. This enables you to simplify your server side code by having it return HTML instead of JSON. This can interfere with Anubis because Anubis challenge pages also return HTML.

### Allow HTMX Requests After Challenge

To work around this, you can make a custom \[expressionexpression rule that allows HTMX requests if the user has passed a challenge in the past:

```yaml theme={null}
- name: allow-htmx-iff-already-passed-challenge
  action: ALLOW
  expression:
    all:
      - '"Cookie" in headers'
      - 'headers["Cookie"].contains("anubis-auth")'
      - '"Hx-Request" in headers'
      - 'headers["Hx-Request"] == "true"'
```

This rule:

1. Checks that the request has cookies
2. Verifies the `anubis-auth` cookie is present
3. Confirms this is an HTMX request via the `Hx-Request` header
4. Allows the request to pass through

<Note>
  This will reduce some security because it does not assert the validity of the Anubis auth cookie, however in trade it improves the experience for existing users.
</Note>

## General Integration Tips

### Setting the Target

Configure Anubis to proxy to your backend application:

```bash theme={null}
TARGET=http://localhost:3000
```

### Custom Headers

If your framework needs specific headers, use the target host configuration:

```bash theme={null}
TARGET_HOST=myapp.example.com
```

### Base Prefix

If your application is served under a subpath:

```bash theme={null}
BASE_PREFIX=/myapp
STRIP_BASE_PREFIX=true
```

### Cookie Domain

For multi-domain setups:

```bash theme={null}
COOKIE_DOMAIN=.example.com
```

Or use dynamic domain detection:

```bash theme={null}
COOKIE_DYNAMIC_DOMAIN=true
```

## Framework-Specific Challenges

### Single Page Applications (SPAs)

For React, Vue, Angular, etc.:

* Ensure your SPA can handle the initial challenge page
* Consider using the `og-passthrough` feature for better social sharing
* Configure proper redirect domains

### API-First Applications

For applications that primarily serve JSON:

* Use the `/api/check` endpoint for auth validation
* Configure policies to ALLOW authenticated API requests
* Consider using JWT restriction headers for additional security

### Server-Side Rendered Applications

For Next.js, Nuxt, SvelteKit, etc.:

* These typically work out of the box
* Ensure cookies are properly forwarded
* Test your build process with Anubis in front

## Troubleshooting

### Redirect Loops

If you're experiencing redirect loops:

1. Check `X-Forwarded-Proto` header handling
2. Verify `COOKIE_SECURE` matches your TLS setup
3. Review `COOKIE_SAME_SITE` configuration

### CORS Issues

If CORS is blocking requests:

1. Ensure your backend CORS settings allow the Anubis cookie
2. Check that `COOKIE_SAME_SITE` is appropriate for your setup
3. Verify `REDIRECT_DOMAINS` includes all necessary origins

### Session Management

If sessions aren't persisting:

1. Configure `COOKIE_EXPIRATION_TIME` appropriately
2. Ensure `ED25519_PRIVATE_KEY_HEX` is set for persistence
3. Verify your store backend is properly configured