External authorization check for forward-auth and Envoy ext_authz
Identity
External authorization check for forward-auth and Envoy ext_authz
Forward-auth endpoint for an Envoy/nginx ext_authz filter.
Checks your Authorization-PSK header and injects x-authz-* and x-auth-method identity
headers for the proxy if valid. Bearer-only requests aren’t handled here.
Depending on your PSK, one of three things happens:
- Valid user PSK: Returns 200 with
x-authz-*andx-auth-methodidentity headers injected. - Invalid PSK or the shared general PSK: Returns 403. The shared general PSK carries no real identity,
so the API blocks it to prevent passing a fixed
pskuser to upstream services. - No PSK: Returns 200 with no
x-authz-*identity headers. JWT takes over.
POST
External authorization check for forward-auth and Envoy ext_authz
Authorizations
Response
Allowed. The API sets identity headers when a valid PSK is present.

