OAuth2 Proxy: Authentication for Everything Behind It
Shriira Press
How a small reverse proxy can put a login screen in front of any application, without changing a single line of that application's code.
Welcome to OAuth2 Proxy: Authentication for Everything Behind It.
OAuth2 Proxy is a reverse proxy and static file server that adds OAuth2 and OpenID Connect authentication to applications that never asked for it. You place it in front of a dashboard, an internal API, or a metrics endpoint that has no login of its own, and it intercepts every request, runs the OAuth2 authorization-code flow against a provider such as Google, Microsoft Entra ID, GitHub, or any generic OIDC issuer, and only then lets the request through to your upstream. This book follows that machine from the outside in: the problem of bolting authentication onto code you cannot change, the OAuth2 flow the proxy performs on each user's behalf, the cookies and sessions that remember them afterward, the providers and authorization rules that decide who gets in, the auth_request pattern that lets a single proxy guard an entire NGINX or Traefik ingress, the identity headers it hands to your backends, and finally how to run it well in production. By the end you will understand not just how to configure OAuth2 Proxy, but why each piece exists.
This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.
A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.
We hope it serves you well.
— Shriira Press