Forward auth wraps apps without changing them

Forward auth protects services from the outside.

With TinyAuth, Authelia, or a similar service behind Traefik or Nginx, the reverse proxy checks the request before forwarding it to the application.

The app does not need to implement login screens, sessions, OAuth callbacks, or whitelists itself.

That is ideal for dashboards, internal tools, homelab services, and apps that were not built with authentication. The auth service owns login, cookies, JWT/session checks, OAuth/OIDC delegation, and email or domain whitelists.

Forward auth is a gateway pattern, not an app feature.

Related:

• How to setup TinyAuth x Traefik with DNS Challenge
• FrontEnd 101. SPAs and ways to do Auth
• SSO tools centralize trust and blast radius
• ThreeBodies repo
• TinyAuth Docker config
• Traefik Docker config
• Traefik proxy configs
• ThreeBodies DNS updater