Envoy External Authorization

This repository demonstrates how to use Envoy proxy with an external authorization service.

Install, build and run

To install the project, follow these steps:

1. Clone the repository:

   git clone https://github.com/ferencsarai/envoy-auth

2. Change into the project directory:

   cd envoy-auth

3. Build the project using Docker Compose:

   docker compose build

4. To run the project, use the following command:

   docker compose up

Usage

Once the project is running, you can send requests to http://localhost:8000 with the User-Agent: Chrome header to get a successful response. Requests with any other User-Agent header will result in a 403 status code.

• Allowed (200) - this will return a response from the echo service http-echo:

  curl -v -A "Chrome" http://localhost:8000

• Not allowed (403):

  # any non-Chrome User-Agent
  curl -v -A "sfjs" http://localhost:8000

How it works

The project utilizes three containers from the docker compose file.

1. Envoy proxy (config)
2. External authorization service (Ruby script)
3. Echo service (http-echo)

Request flow

Allowed request (200)

sequenceDiagram
    participant Client
    participant Envoy as Envoy Proxy<br/>(port 8000)
    participant Auth as Auth Service<br/>(port 3000)
    participant Echo as Echo Service<br/>(port 8080)

    Client->>Envoy: GET / (User-Agent: Chrome)
    Envoy->>Auth: forward User-Agent header
    Auth-->>Envoy: 200 OK
    Envoy->>Echo: forward original request
    Echo-->>Envoy: 200 OK + echoed request
    Envoy-->>Client: 200 OK + echoed request

Loading

Denied request (403)

sequenceDiagram
    participant Client
    participant Envoy as Envoy Proxy<br/>(port 8000)
    participant Auth as Auth Service<br/>(port 3000)
    participant Echo as Echo Service<br/>(port 8080)

    Client->>Envoy: GET / (User-Agent: sfjs)
    Envoy->>Auth: forward User-Agent header
    Auth-->>Envoy: 403 Forbidden
    Envoy-->>Client: 403 Forbidden
    Note over Echo: never reached

Loading

Configuration

Envoy proxy configuration: envoy.yaml

Contributing

See CONTRIBUTING.md for guidelines. Please also review our CODE_OF_CONDUCT.md and CODEOWNERS.

License

This project is licensed under the terms of the MIT License.