Auth Proxy Patterns — Authentication Proxy Architectures

// Nginx auth request configuration
// nginx.conf
location /api/ {
  auth_request /auth-proxy/validate;

  # Pass user info from auth response to backend
  auth_request_set $user_id $upstream_http_x_user_id;
  auth_request_set $user_roles $upstream_http_x_user_roles;
  proxy_set_header X-User-ID $user_id;
  proxy_set_header X-User-Roles $user_roles;

  proxy_pass http://backend:3000;
}

location /auth-proxy/ {
  internal;
  proxy_pass http://auth-service:8080/validate;
  proxy_pass_request_body off;
  proxy_set_header Content-Length "";
  proxy_set_header X-Original-URI $request_uri;
  proxy_set_header X-Original-Method $request_method;
}

// Auth proxy service
app.post('/validate', async (req, res) => {
  const token = extractToken(req);
  if (!token) return res.status(401).end();

  try {
    const decoded = await validateToken(token);
    res.setHeader('X-User-ID', decoded.sub);
    res.setHeader('X-User-Roles', decoded.role?.join(',') || '');
    res.status(200).end();
  } catch {
    res.status(401).end();
  }
});

// Envoy external auth filter
// envoy.yaml
http_filters:
- name: envoy.ext_authz
  config:
    grpc_service:
      envoy_grpc:
        cluster_name: auth-service
    with_request_body:
      max_request_bytes: 1024