🚀 Feature: Add support of ForwardAuth #341

New Issue

OVERLORD · 2025-10-07T00:11:18+03:00

OVERLORD commented

2025-10-07 00:11:18 +03:00

Originally created by @im2R on GitHub.

Feature description

Implementation of ForwardAuth to protect applications not supporting OIDC through reverse proxies

Pitch

Hi,

I use Traefik as a reverse proxy to expose Docker containerized services to the internet. For securing access to these applications, I currently use Authelia, which supports forward authentication. This allows me to protect services that don't natively support OIDC using Traefik's ForwardAuth middleware.

I request that Pocket ID implements support for forward authentication, this would allow seamless integration with Traefik (or other reverse proxies) and provide a more native and well-integrated solution compared to alternatives like traefik-oidc-auth or oauth2-proxy.

Use Case Example

With Authelia, I can set up forward authentication using the following Traefik labels:

For the authentication service:

- traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/authz/forward-auth
- traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true
- traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email

For the protected applications:

- traefik.http.routers.whoami.middlewares=authelia@docker

Thanks!

Originally created by @im2R on GitHub. ### Feature description Implementation of ForwardAuth to protect applications not supporting OIDC through reverse proxies ### Pitch Hi, I use Traefik as a reverse proxy to expose Docker containerized services to the internet. For securing access to these applications, I currently use Authelia, which supports forward authentication. This allows me to protect services that don't natively support OIDC using [Traefik's ForwardAuth middleware](https://doc.traefik.io/traefik/middlewares/http/forwardauth/). I request that Pocket ID implements support for forward authentication, this would allow seamless integration with Traefik (or other reverse proxies) and provide a more native and well-integrated solution compared to alternatives like [traefik-oidc-auth](https://github.com/sevensolutions/traefik-oidc-auth) or [oauth2-proxy](https://github.com/oauth2-proxy/oauth2-proxy). ### Use Case Example With Authelia, I can set up forward authentication using the following Traefik labels: For the authentication service: ``` - traefik.http.middlewares.authelia.forwardauth.address=http://authelia:9091/api/authz/forward-auth - traefik.http.middlewares.authelia.forwardauth.trustForwardHeader=true - traefik.http.middlewares.authelia.forwardauth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email ``` For the protected applications: ``` - traefik.http.routers.whoami.middlewares=authelia@docker ``` Thanks!

OVERLORD added the feature label 2025-10-07 00:11:18 +03:00

OVERLORD closed this issue

2025-10-07 00:11:19 +03:00

OVERLORD commented

2025-10-07 00:11:20 +03:00

@stonith404 commented on GitHub:

As Pocket ID is solely an OIDC provider I don't think this makes sense to directly implement this into Pocket ID. I understand that it might be not the ideal solution to use non native solution like oauth2-proxy but the goal of Pocket ID is to stay simple.

@stonith404 commented on GitHub: As Pocket ID is solely an OIDC provider I don't think this makes sense to directly implement this into Pocket ID. I understand that it might be not the ideal solution to use non native solution like oauth2-proxy but the goal of Pocket ID is to stay simple.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#341