Nginx implemented with a reverse proxy, with a sub request to the built in auth module. Basically, you can forward portions of a http request (cookie or bearer

Nginx implemented with a reverse proxy, with a sub request to the built in auth module. Basically, you can forward portions of a http request (cookie or bearer token) to another service not accessible directly by the user. That serverice responds with a 200 or not, and the request is allowed, or not. It's real simple, I've hooked something up to the discord API and other methods like this. Usually, one uses a already built identity system with RBAC built in. Check out ory kratos and ory oathkeeper. Those fit right in. https://nginx.org/en/docs/http/ngx_http_auth_request_module.html https://nginx.org/en/docs/http/ngx_http_auth_request_module.... Granted, you should always validate the authorization on the application side too, but this just adds another layer of security.