Question: Am I able to influence a HTTP response from upstream based on the headers it returns, by doing a sub-request?

We have an application that is able to define for example if the user should be logged in to view a page or not. Or if the user needs a specific permission/role to view it.

I preferably do not want to send an auth_request (or the lua variant of it) for every incoming request.

I do not know in advance if a page has this information configured (which, in case it is not configured, means that no additional access rights are applicable). This will more often be the case, since only select pages will have security settings configured.

There are various options:

1. Request the page from the upstream, let the upstream include (for example in the response headers) information about what permissions/login states are required, then use the power of Lua to determine if the user has the correct permissions (which involves decrypting the JWT token, etc) -- I think this is way too much of a hassle to program in Nginx/Lua;
2. Same as 1, but when the response is obtained from the upstream, invoke a subrequest to a dedicated endpoint, which is able to verify the permissions and return OK yes/no -- I'm unable to do this, because in header_filter_by_lua_block I'm unable to invoke subrequest, as per the documentation;
3. Perform an auth_request (the Lua one) (which needs to be done always, as I will never know whether there are additional security settings applicable), to determine if the page has security settings and let it return OK yes/no -- This requires me to always do this auth_request (and thus processing), when it's often not needed.

Do you see any other possibilities to solve this problem?

Review the documented constraints around header_filter_by_lua_block, auth_request, and subrequests. Determine whether the requested response-header-driven authorization flow is supported; done means identifying a feasible supported approach or clearly documenting that it is not.