notes
Identity: one login, and the bypass I shipped
The problem
More than a dozen self-hosted services, each with its own login page and its own idea of a session. I wanted one identity provider in front of all of them, and no service inventing its own auth.
The shape
request → reverse proxy → forward-auth → identity provider
↓ authenticated
service (no auth logic of its own)
The hard part
Forward-auth means the proxy asks the identity provider about every request before passing it upstream, so the proxy's matching rules are the security boundary. I added a path pattern to skip the auth check for a category of requests that genuinely needed to bypass it, and the pattern was broader than I intended. It matched across every host behind the proxy, not just the one I was thinking about — a fleet-wide bypass introduced by a rule that read correctly and matched incorrectly.
What made it dangerous is that nothing broke. Every service kept working, every page kept loading, and the only visible difference was the absence of a challenge nobody was looking for. Auth changes need a test that asserts a request is refused, because the failure mode of an auth bug is that everything appears fine.