And the point of this is that, while application security is still important, it at least makes all those vulnerabilities post-auth, which is a huge improvement

And the point of this is that, while application security is still important, it at least makes all those vulnerabilities post-auth, which is a huge improvement. The poor man's version of this is to put all your services behind an nginx reverse proxy with HTTP Basic auth (and TLS of course). For personal/small scale operations, this is a great way to almost completely eliminate your attack surface, if you have single-digit users and they can be trusted. Everyone running webapps personally should prefer this over, or in addition to, app-specific login systems.