From cf5d5cab6e424b0b599ced2d816dd83ebb7ec419 Mon Sep 17 00:00:00 2001
From: Stavros <steveiliop56@gmail.com>
Date: Fri, 21 Aug 2026 13:26:02 +0300
Subject: [PATCH] feat: add option to disable auth module fallbacks

---
 .env.example                            |  2 ++
 internal/controller/proxy_controller.go | 15 +++++++++++++--
 internal/model/config.go                |  3 ++-
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.env.example b/.env.example
index 770a7e97..abc91238 100644
--- a/.env.example
+++ b/.env.example
@@ -227,6 +227,8 @@ TINYAUTH_LDAP_GROUPCACHETTL=900
 
 # Enable the OAuth bridge, uses a new way to format OAuth user information.
 TINYAUTH_EXPERIMENTAL_OAUTHBRIDGEENABLED=false
+# Disable the fallback to forward_auth modules when auth_request or ext_authz fail.
+TINYAUTH_EXPERIMENTAL_DISABLEAUTHMODULEFALLBACK=false
 
 # tailscale config
 
diff --git a/internal/controller/proxy_controller.go b/internal/controller/proxy_controller.go
index 57b56e4d..93f8d6a0 100644
--- a/internal/controller/proxy_controller.go
+++ b/internal/controller/proxy_controller.go
@@ -57,6 +57,7 @@ type ProxyContext struct {
 type ProxyController struct {
 	log          *logger.Logger
 	runtime      *model.RuntimeConfig
+	config       *model.Config
 	acls         *service.AccessControlsService
 	auth         *service.AuthService
 	policyEngine *service.PolicyEngine
@@ -67,6 +68,7 @@ type ProxyControllerInput struct {
 
 	Log           *logger.Logger
 	RuntimeConfig *model.RuntimeConfig
+	Config        *model.Config
 	RouterGroup   *gin.RouterGroup `name:"apiRouterGroup"`
 	ACLsService   *service.AccessControlsService
 	AuthService   *service.AuthService
@@ -77,6 +79,7 @@ func NewProxyController(i ProxyControllerInput) *ProxyController {
 	controller := &ProxyController{
 		log:          i.Log,
 		runtime:      i.RuntimeConfig,
+		config:       i.Config,
 		acls:         i.ACLsService,
 		auth:         i.AuthService,
 		policyEngine: i.PolicyEngine,
@@ -486,9 +489,17 @@ func (controller *ProxyController) determineAuthModules(proxy ProxyType) []AuthM
 	case Traefik, Caddy:
 		return []AuthModuleType{ForwardAuth}
 	case Envoy:
-		return []AuthModuleType{ExtAuthz, ForwardAuth}
+		authModules := []AuthModuleType{ExtAuthz}
+		if !controller.config.Experimental.DisableAuthModuleFallback {
+			authModules = append(authModules, ForwardAuth)
+		}
+		return authModules
 	case Nginx:
-		return []AuthModuleType{AuthRequest, ForwardAuth}
+		authModules := []AuthModuleType{AuthRequest}
+		if !controller.config.Experimental.DisableAuthModuleFallback {
+			authModules = append(authModules, ForwardAuth)
+		}
+		return authModules
 	default:
 		return []AuthModuleType{}
 	}
diff --git a/internal/model/config.go b/internal/model/config.go
index 5b077fc5..55c66a38 100644
--- a/internal/model/config.go
+++ b/internal/model/config.go
@@ -239,7 +239,8 @@ type LogStreamConfig struct {
 }
 
 type ExperimentalConfig struct {
-	OAuthBridgeEnabled bool `description:"Enable the OAuth bridge, uses a new way to format OAuth user information." yaml:"oauthBridgeEnabled,omitempty"`
+	OAuthBridgeEnabled        bool `description:"Enable the OAuth bridge, uses a new way to format OAuth user information." yaml:"oauthBridgeEnabled,omitempty"`
+	DisableAuthModuleFallback bool `description:"Disable the fallback to forward_auth modules when auth_request or ext_authz fail." yaml:"disableAuthModuleFallback,omitempty"`
 }
 
 type TailscaleConfig struct {