Repository navigation
[FEATURE] Support Envoy Proxy #527
Description
Is your feature request related to a problem? Please describe.
Allow tinyauth to be used as an external authorizer for the ext_authz extension in Envoy Proxy(and Istio).
Describe the solution you'd like
I've been able to get Tinyauth to work with Istio by configuring an external auth provider through ext_authz - pointing to /api/auth/caddy. This works for any GET requests meant for the upstream. However any POST(and potentially other) requests fail with a 404 because Envoy uses the original method when contacting Tinyauth while Tinyauth only supports GET currently. More info about this behaviour in Envoy can be found here: envoyproxy/envoy#5357 (comment)
Adding support for Envoy in Tinyauth would require exposing other HTTP methods. I was able to get this to work by changing the code to:
proxyGroup.Any("/:proxy", controller.proxyHandler)However, I've no idea what the consequences of such a change will be to other proxy implementations.
Describe alternatives you've considered
dev setup that worked: main...pushpinderbal:tinyauth:main
Additional context
Relevant Istio Configuration for reference:
meshConfig:
extensionProviders:
- name: "authz-tinyauth"
envoyExtAuthzHttp:
service: "auth-tinyauth.auth.svc.cluster.local"
port: "80"
pathPrefix: "/api/auth/envoy?path="
includeRequestHeadersInCheck: ["cookie", "x-forwarded-for", "x-forwarded-proto", "x-forwarded-host", "accept"]
includeAdditionalHeadersInCheck:
"x-forwarded-proto": "%REQ(:SCHEME)%"
"x-forwarded-host": "%REQ(:AUTHORITY)%"
"x-forwarded-uri": "%REQ(:PATH)%"
"x-forwarded-method": "%REQ(:METHOD)%"
headersToDownstreamOnAllow: ["set-cookie"]
headersToDownstreamOnDeny: ["content-type", "set-cookie"]---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: ext-authz-z2m
namespace: ingress
spec:
targetRefs:
- kind: Gateway
group: gateway.networking.k8s.io
name: ingress-gateway-private
action: CUSTOM
provider:
name: authz-tinyauth
rules:
- to:
- operation:
hosts:
- z2m.example.local.com
Activity
coderabbitai commentedon Dec 18, 2025
📝 CodeRabbit Plan Mode
Generate an implementation plan and prompts that you can use with your favorite coding agent.
Examples
🔗 Similar Issues
Related Issues
🔗 Related PRs
tinyauthapp/docs#11 - feat: add new remote headers to zitadel-oauth example [merged]
tinyauthapp/docs#18 - chore: enrich header section for necessity of passing header and exam… [merged]
#422 - feat: ACL labels from environment variables [merged]
👤 Suggested Assignees
🧪 Issue enrichment is currently in open beta.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord or schedule a call!
pushpinderbal commentedon Dec 18, 2025
created draft #532, would appreciate guidance/feedback so it can be merged.
steveiliop56 commentedon Dec 22, 2025
Added with #538.