The Forward-Auth Gate That Verified Perfectly — and Wasn't Live

Описание и применение

Проблема заключалась в том, что входящий трафик через Cloudflare Tunnel обходил шлюз authentik, позволяя неавторизованным пользователям обращаться к приложению. После перенаправления трафика в outpost authentik все запросы проходят аутентификацию.

Задача

A self‑hosted app was protected by an authentik forward‑auth gate, but the gate was only applied to traffic entering via nginx; public traffic routed through a Cloudflare Tunnel bypassed the gate, exposing the app to unauthenticated access.

Результат

After updating the Cloudflare Tunnel rule, all public traffic to https://app.example.com is routed through authentik’s forward‑auth gate, preventing unauthenticated access to the app.

Рабочий процесс

• 1. Configure authentik proxy provider with external host https://app.example.com and internal host http://app-container:8080.
• 2. Create an authentik application linked to the proxy provider and the outpost.
• 3. Point nginx vhost for app.example.com to the authentik outpost.
• 4. Verify the gate by curling localhost with Host header, confirming 302 redirect and x‑powered‑by: authentik.
• 5. Discover that public traffic bypasses nginx and hits the Cloudflare Tunnel directly.
• 6. Inspect Cloudflare Tunnel configuration via API to find the rule app.example.com -> http://app-container:8080.
• 7. Update the tunnel rule to app.example.com -> http://authentik-server:9000 (the outpost).
• 8. Test public access again, confirming 302 redirect and x‑powered‑by: authentik.
• 9. Optionally configure skip_path_regex in the proxy provider to exempt API paths from the gate.

Доказательства

I finished the gate, ran the check, and it passed.

Источник

An unauthenticated request was being pushed to my authentik login page. Branded, correct, working.

Источник

The app answered directly. No login page, no redirect, no gate.

Источник

The tunnel’s ingress is a small ordered list evaluated per hostname: app.example.com -> http://app-container:8080 ← straight to the app * -> http_status:404

Источник

What finally made it obvious was a response header. The gated check returned x-powered-by: authentik. The public check returned x-powered-by: Express.

Источник