ext-authz

Typed-judgment admission control at the traffic edge: three-layer prompt-injection and abuse filter for nginx/OpenResty, powered by TypeSafe Jev. Fail-open, cached, hot-reloadable.

Collection of protobuf types to work with the Envoy Proxy through Rust services.

An implementation of Envoy External Authorization

Example showing how to implement an Envoy External Authorization gRPC Server written in Rust.

A forward authentication / authorisation (authN) implementation of Envoy External Authorization (ext_authz), built with Contour, and Pomerium in mind.

An Envoy External Authorization (ext_authz) service for ensuring requests are authenticated through Cloudflare Access, built with Contour in mind.

Example showing how to implement an Envoy External Authorization gRPC Server written in Rust, with basic rate-limiting.

Envoy/Istio ext-authz and ext-proc service driven by CEL policies: gate requests and mutate live traffic from one config.

IP Block protection for Envoy — ip-block.com integration. Untested at the moment; please feel free to modify. GPLv3.

This repo implements Envoy proxy's ext-authz to demonstrate routing to upstream endpoints.

OCSP revocation checking for mTLS client certificates, as an Envoy ext_authz service — the check Envoy doesn't do. Fail-closed; works with kgateway, Istio, or any Envoy-based gateway.

Real Time Reverse Proxy Fail To ban

Zero-trust enforcement point in front of AI agent tools: SPIFFE identity, attestation, policy, trust, DLP

Runnable Envoy ext_proc and ext_authz callout credential injection demo

Educational Envoy ext_authz lab that combines MobileBERT and deterministic checks to block SQL injection and prompt-injection payloads.

OIDC authentication for Traefik and ext_authz gateways

An example of how to setup ext auth using a simple nodejs authenticator

Istio External Authorization (ext-authz) sandbox testing a custom Go external authorizer, path-based JWT validation, and target apps.

A simple envoy ext_authz server.

Minimal, runnable example of Envoy's ext_authz filter — external HTTP authorization with Docker Compose in under 5 minutes.