{"id":17308705,"url":"https://github.com/pasdam/envoy-external-auth-with-rate-limiting","last_synced_at":"2026-07-10T06:31:20.196Z","repository":{"id":54877598,"uuid":"331351302","full_name":"pasdam/envoy-external-auth-with-rate-limiting","owner":"pasdam","description":"Docker compose playground to test Envoy external auth and rate limiting","archived":false,"fork":false,"pushed_at":"2023-06-28T08:54:19.000Z","size":41,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-24T08:42:31.431Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pasdam.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-01-20T15:38:16.000Z","updated_at":"2023-06-23T06:44:46.000Z","dependencies_parsed_at":"2024-12-05T08:08:54.519Z","dependency_job_id":"b269cbd2-6a17-4d71-94b2-98b2425cc291","html_url":"https://github.com/pasdam/envoy-external-auth-with-rate-limiting","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/pasdam/envoy-external-auth-with-rate-limiting","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pasdam%2Fenvoy-external-auth-with-rate-limiting","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pasdam%2Fenvoy-external-auth-with-rate-limiting/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pasdam%2Fenvoy-external-auth-with-rate-limiting/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pasdam%2Fenvoy-external-auth-with-rate-limiting/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pasdam","download_url":"https://codeload.github.com/pasdam/envoy-external-auth-with-rate-limiting/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pasdam%2Fenvoy-external-auth-with-rate-limiting/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35323809,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-10T02:00:06.465Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-15T12:05:50.283Z","updated_at":"2026-07-10T06:31:20.174Z","avatar_url":"https://github.com/pasdam.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# External auth and rate limiting with Envoy\n\nThis repo contains a playground to test external authentication and rate\nlimiting flow in [Envoy proxy](https://envoyproxy.io/).\n\nThere are 2 different versions of the playground one that uses directly\n[Envoy](https://envoyproxy.io/) as ingress and another one that uses\n[Gloo Edge](https://www.solo.io/products/gloo-edge/).\n\n## Components\n\nThe playground components are:\n\n* [Backend](./backend/): it processes the request returning a simple hello\n  message;\n* [External authentication service](./extauth/): it verifies the authentication\n  token;\n* [Rate limiter](https://github.com/envoyproxy/ratelimit): it verify the rate of\n  the requests using the header added by the auth service; it uses redis to\n  cache the status; for this example we use the implementation provided by envoy\n  itself;\n* [Envoy](https://envoyproxy.io/): it works as ingress and verify the request\n  using the external authentication service and rate limiter;\n* [Gloo Edge](https://www.solo.io/products/gloo-edge/): it works as API gateway,\n  it's basically a wrapper around Envoy.\n\n## Flow\n\nThe call flow is:\n\n1. client call endpoint with bearer token in the header;\n2. envoy verify the request against the external authentication service: if the\n   token in the header is valid it proceed with the following steps, otherwise\n   it will return a `401 Unauthorized` error immediately without passing the\n   request to the backend;\n3. envoy will verify the request with the rate limiter: if the request is\n   invalid it will return `` immediately, otherwise will pass the request to\n   the backend;\n4. the backend process the request and returns a response.\n\n## Usage\n\n### Build and run\n\nTo build and run the playground with Envoy just run the following:\n\n```sh\ndocker compose up\n```\n\nTo build and run the the one with Gloo:\n\n```sh\ndocker compose -f docker-compose-gloo.yaml up\n```\n\n### Test authentication\n\nTo call the backend a bearer token must be passed in, e.g.\n\n```sh\n$ curl -v -H \"Authorization: Bearer user-1-token\" http://localhost:8080\n*   Trying ::1...\n* TCP_NODELAY set\n* Connected to localhost (::1) port 8080 (#0)\n\u003e GET /slowpath HTTP/1.1\n\u003e Host: localhost:8080\n\u003e User-Agent: curl/7.64.1\n\u003e Accept: */*\n\u003e Authorization: Bearer user-1-token\n\u003e\n\u003c HTTP/1.1 200 OK\n\u003c date: Wed, 20 Jan 2021 18:55:34 GMT\n\u003c content-length: 198\n\u003c content-type: text/plain; charset=utf-8\n\u003c x-envoy-upstream-service-time: 0\n\u003c server: envoy\n\u003c\nHello user-1!\nX-Envoy-Expected-Rq-Timeout-Ms: 15000\nContent-Length: 0\nUser-Agent: curl/7.64.1\nAccept: */*\nX-Forwarded-Proto: http\nX-Request-Id: 9bd6d869-5a7e-479e-9557-ba0485c56559\n* Connection #0 to host localhost left intact\nX-User-Id: user-1* Closing connection 0\n```\n\nIf the token is invalid the response is a `401`.\n\n### Test rate limiting\n\nTo test the rate limiting we can use the `/slowpath` endpoint which has a policy\nof 2 requests per minute, after that it will reply with:\n\n```sh\n$ curl -v -H \"Authorization: Bearer user-1-token\" http://localhost:8080/slowpath\n*   Trying ::1...\n* TCP_NODELAY set\n* Connected to localhost (::1) port 8010 (#0)\n\u003e GET /slowpath HTTP/1.1\n\u003e Host: localhost:8010\n\u003e User-Agent: curl/7.64.1\n\u003e Accept: */*\n\u003e Authorization: Bearer user-1-token\n\u003e\n\u003c HTTP/1.1 429 Too Many Requests\n\u003c x-envoy-ratelimited: true\n\u003c date: Wed, 20 Jan 2021 18:55:42 GMT\n\u003c server: envoy\n\u003c content-length: 0\n\u003c\n* Connection #0 to host localhost left intact\n* Closing connection 0\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpasdam%2Fenvoy-external-auth-with-rate-limiting","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpasdam%2Fenvoy-external-auth-with-rate-limiting","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpasdam%2Fenvoy-external-auth-with-rate-limiting/lists"}