{"slug": "oauth2-proxy", "name": "oauth2-proxy", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 3, "commenters": 4, "warners": 0, "score": 2.901, "rising": 0.35, "first": "2025-12-12", "latest": "2026-10-02", "why": "I've been happily using oauth2-proxy[1] with nginx as an extra layer of authentication", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 1, "compare": 0, "warn": 0}, "spark": [0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "I've been happily using oauth2-proxy[1] with nginx as an extra layer of authentication", "kind": "", "icon": true, "domain": null, "github_repo": "github.com/oauth2-proxy/oauth2-proxy", "official_url": "https://oauth2-proxy.github.io/oauth2-proxy/", "pricing": "", "aliases": ["oauth2-proxy"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 798965154, "item_id": 49935322, "url": "https://news.ycombinator.com/item?id=49935322", "by": "billfor", "date": "2026-10-02", "stance": "recommend", "quote": "put something like vouch proxy or oauth2-proxy in front of the endpoint", "excerpt": "OpenHAB cloud is free, https://www.myopenhab.org/, but I think for most technical people, just reverse proxy what you have (HA, OH, etc...) and put something like vouch proxy or oauth2-proxy in front of the endpoint. I don't want any cloud standing in the way of my door lock opening.", "context": "", "use_case": "", "switched_from": "", "story": "Big Tech ruined the cloud, so we're renaming ours"}, {"id": 753580416, "item_id": 47098776, "url": "https://news.ycombinator.com/item?id=47098776", "by": "emilburzo", "date": "2026-02-21", "stance": "recommend", "quote": "I've been happily using oauth2-proxy[1] with nginx as an extra layer of authentication", "excerpt": "I've been happily using oauth2-proxy[1] with nginx as an extra layer of authentication to prevent situations where e.g. home-assistant had an unauthenticated RCE. It's pretty neat since you can have one oauth instances for all virtual hosts, e.g.: server { [...] location /oauth2/ { proxy_pass http://127.0.0.1:8469; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Scheme $scheme", "context": "", "use_case": "Auth layer for self-hosted apps", "switched_from": "", "story": "What Is OAuth?"}, {"id": 739940352, "item_id": 46246272, "url": "https://news.ycombinator.com/item?id=46246272", "by": "craftkiller", "date": "2025-12-12", "stance": "recommend", "quote": "My solution was to put the web interface for those repos behind oauth2-proxy", "excerpt": "On my forge, I mirror some large repos that I use for CI jobs so I'm not putting unfair load on the upstream project's repos. Those are the only repos large enough to cause problems with the asshole AI scrapers. My solution was to put the web interface for those repos behind oauth2-proxy (while leaving the direct git access open to not impact my CI jobs). It made my CPU usage drop 80% instantly, while still leaving m", "context": "self-hosts a git forge mirroring large repos for CI", "use_case": "blocking AI scrapers on git forge", "switched_from": "", "story": "Guarding My Git Forge Against AI Scrapers"}]}], "caveats": [], "who": [{"by": "craftkiller", "context": "self-hosts a git forge mirroring large repos for CI", "url": "https://news.ycombinator.com/item?id=46246272", "date": "2025-12-12"}], "tags": [], "use_cases": ["auth layer for self-hosted apps", "blocking ai scrapers on git forge"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49934228", "title": "Big Tech ruined the cloud, so we're renaming ours", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47096520", "title": "What Is OAuth?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46766432", "title": "OSS ChatGPT WebUI \u2013 530 Models, MCP, Tools, Gemini RAG, Image/Audio Gen", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46241849", "title": "Guarding My Git Forge Against AI Scrapers", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 1}, "2026-01": {"neutral": 1}, "2026-02": {"recommend": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"recommend": 1}}, "quotes": [{"id": 798965154, "item_id": 49935322, "url": "https://news.ycombinator.com/item?id=49935322", "by": "billfor", "date": "2026-10-02", "stance": "recommend", "quote": "put something like vouch proxy or oauth2-proxy in front of the endpoint", "excerpt": "OpenHAB cloud is free, https://www.myopenhab.org/, but I think for most technical people, just reverse proxy what you have (HA, OH, etc...) and put something like vouch proxy or oauth2-proxy in front of the endpoint. I don't want any cloud standing in the way of my door lock opening.", "context": "", "use_case": "", "switched_from": "", "story": "Big Tech ruined the cloud, so we're renaming ours"}, {"id": 753580416, "item_id": 47098776, "url": "https://news.ycombinator.com/item?id=47098776", "by": "emilburzo", "date": "2026-02-21", "stance": "recommend", "quote": "I've been happily using oauth2-proxy[1] with nginx as an extra layer of authentication", "excerpt": "I've been happily using oauth2-proxy[1] with nginx as an extra layer of authentication to prevent situations where e.g. home-assistant had an unauthenticated RCE. It's pretty neat since you can have one oauth instances for all virtual hosts, e.g.: server { [...] location /oauth2/ { proxy_pass http://127.0.0.1:8469; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Scheme $scheme", "context": "", "use_case": "Auth layer for self-hosted apps", "switched_from": "", "story": "What Is OAuth?"}, {"id": 748366817, "item_id": 46772926, "url": "https://news.ycombinator.com/item?id=46772926", "by": "hobofan", "date": "2026-01-26", "stance": "neutral", "quote": "We are leveraging oauth2-proxy for the login here", "excerpt": "If you are looking for a open source Chat WebUI with support for OIDC, maybe you are interested in the one we are building?[0] We are leveraging oauth2-proxy for the login here, so it should support all OIDC-compliant IDPs, and there are some guides by oauth2-proxy on how to configure for all the bigger providers. We do have customers using it with e.g. Azure, Keycloak, Google Directory. [0]: https://erato.chat", "context": "", "use_case": "", "switched_from": "", "story": "OSS ChatGPT WebUI \u2013 530 Models, MCP, Tools, Gemini RAG, Image/Audio Gen"}, {"id": 739940352, "item_id": 46246272, "url": "https://news.ycombinator.com/item?id=46246272", "by": "craftkiller", "date": "2025-12-12", "stance": "recommend", "quote": "My solution was to put the web interface for those repos behind oauth2-proxy", "excerpt": "On my forge, I mirror some large repos that I use for CI jobs so I'm not putting unfair load on the upstream project's repos. Those are the only repos large enough to cause problems with the asshole AI scrapers. My solution was to put the web interface for those repos behind oauth2-proxy (while leaving the direct git access open to not impact my CI jobs). It made my CPU usage drop 80% instantly, while still leaving m", "context": "self-hosts a git forge mirroring large repos for CI", "use_case": "blocking AI scrapers on git forge", "switched_from": "", "story": "Guarding My Git Forge Against AI Scrapers"}]}