External Authorization for Your Web Apps

# authelia configuration.yml (relevant parts)
access_control:
  default_policy: two_factor
  rules:
    - domain: app.example.com
      policy: two_factor
      subject:
        - 'group:developers'

session:
  cookies:
    - domain: example.com
      authelia_url: https://auth.example.com

app.example.com {
    forward_auth authentik-server:9000 {
        uri /outpost.goauthentik.io/auth/caddy
        copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name
    }
    reverse_proxy your-app:8080
}

server {
    listen 443 ssl;
    server_name app.example.com;

    # Auth subrequest
    auth_request /validate;
    auth_request_set $auth_user $upstream_http_x_vouch_user;
    auth_request_set $auth_email $upstream_http_x_vouch_idp_claims_email;

    # Forward to backend with user info
    proxy_set_header Remote-User $auth_user;
    proxy_set_header Remote-Email $auth_email;

    location = /validate {
        internal;
        proxy_pass http://vouch:9090/validate;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
    }

    location / {
        proxy_pass http://your-app:8080;
    }
}

package auth

import (
	"context"
	"net/http"
	"strings"
)

type User struct {
	Username string
	Email    string
	Name     string
	Groups   []string
}

type contextKey string

const userContextKey contextKey = "auth_user"

// TrustedHeaderAuth is middleware that reads identity headers
// set by a reverse proxy (Authelia, Authentik, etc.)
func TrustedHeaderAuth(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		username := r.Header.Get("Remote-User")
		if username == "" {
			http.Error(w, "Unauthorized", http.StatusUnauthorized)
			return
		}

		user := &User{
			Username: username,
			Email:    r.Header.Get("Remote-Email"),
			Name:     r.Header.Get("Remote-Name"),
		}

		if groups := r.Header.Get("Remote-Groups"); groups != "" {
			user.Groups = strings.Split(groups, ",")
		}

		ctx := context.WithValue(r.Context(), userContextKey, user)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

// UserFromContext retrieves the authenticated user from the request context.
func UserFromContext(ctx context.Context) *User {
	user, _ := ctx.Value(userContextKey).(*User)
	return user
}

// RequireGroup returns middleware that checks group membership.
func RequireGroup(group string) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			user := UserFromContext(r.Context())
			if user == nil {
				http.Error(w, "Unauthorized", http.StatusUnauthorized)
				return
			}
			for _, g := range user.Groups {
				if strings.TrimSpace(g) == group {
					next.ServeHTTP(w, r)
					return
				}
			}
			http.Error(w, "Forbidden", http.StatusForbidden)
		})
	}
}

func main() {
	mux := http.NewServeMux()

	// Public health check (no auth needed, proxy should bypass this)
	mux.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
		w.Write([]byte("ok"))
	})

	// Protected routes
	protected := http.NewServeMux()
	protected.HandleFunc("/dashboard", dashboardHandler)
	protected.HandleFunc("/profile", profileHandler)

	// Admin-only routes
	admin := http.NewServeMux()
	admin.HandleFunc("/admin/users", usersHandler)

	mux.Handle("/", auth.TrustedHeaderAuth(protected))
	mux.Handle("/admin/", auth.TrustedHeaderAuth(
		auth.RequireGroup("admins")(admin),
	))

	// Listen only on localhost — proxy handles external traffic
	http.ListenAndServe("127.0.0.1:8080", mux)
}

func dashboardHandler(w http.ResponseWriter, r *http.Request) {
	user := auth.UserFromContext(r.Context())
	fmt.Fprintf(w, "Hello, %s (%s)", user.Name, user.Email)
}

<?php

function getAuthUser(): ?array
{
    $username = $_SERVER['HTTP_REMOTE_USER'] ?? '';

    if (empty($username)) {
        return null;
    }

    return [
        'username' => $username,
        'email'    => $_SERVER['HTTP_REMOTE_EMAIL'] ?? '',
        'name'     => $_SERVER['HTTP_REMOTE_NAME'] ?? '',
        'groups'   => array_filter(
            array_map('trim', explode(',', $_SERVER['HTTP_REMOTE_GROUPS'] ?? ''))
        ),
    ];
}

function requireAuth(): array
{
    $user = getAuthUser();

    if ($user === null) {
        http_response_code(401);
        echo 'Unauthorized';
        exit;
    }

    return $user;
}

function requireGroup(string $group): array
{
    $user = requireAuth();

    if (!in_array($group, $user['groups'], true)) {
        http_response_code(403);
        echo 'Forbidden';
        exit;
    }

    return $user;
}

// Usage
$user = requireAuth();
echo "Welcome, {$user['name']}";

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class TrustedHeaderAuth
{
    public function handle(Request $request, Closure $next, ?string $requiredGroup = null)
    {
        $username = $request->header('Remote-User');

        if (empty($username)) {
            abort(401, 'Unauthorized');
        }

        $groups = array_filter(
            array_map('trim', explode(',', $request->header('Remote-Groups', '')))
        );

        if ($requiredGroup && !in_array($requiredGroup, $groups, true)) {
            abort(403, 'Forbidden');
        }

        // Make user info available throughout the request
        $request->merge([
            'auth_user' => [
                'username' => $username,
                'email'    => $request->header('Remote-Email', ''),
                'name'     => $request->header('Remote-Name', ''),
                'groups'   => $groups,
            ],
        ]);

        return $next($request);
    }
}

// routes/web.php
Route::middleware('trusted-header-auth')->group(function () {
    Route::get('/dashboard', [DashboardController::class, 'index']);
});

Route::middleware('trusted-header-auth:admins')->group(function () {
    Route::get('/admin', [AdminController::class, 'index']);
});

// Go: Validate source IP before trusting headers
func TrustedProxyOnly(proxyIP string, next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        host, _, _ := net.SplitHostPort(r.RemoteAddr)
        if host != proxyIP {
            http.Error(w, "Forbidden", http.StatusForbidden)
            return
        }
        next.ServeHTTP(w, r)
    })
}