Protect a web app

Put your project's sign-in in front of a service people open in a browser, choose who may open it, and read who is signed in from request headers.

Zero-Code gives a service that has no sign-in of its own, such as a monitoring tool or an internal tool, your project's sign-in. A person who opens the service is sent to your project's sign-in page and brought back with a session, with no change to the service's code.

Before you begin

You need:

• A cluster with Zero-Code installed. See Install Zero-Code on a cluster.
• A hostname for the service, and the ability to change its DNS. This guide uses grafana.acme.com.
• The groups that should be able to open the service. See Roles, groups and grants.

Check that it works

In a browser with no session, open a page on the service:

https://grafana.acme.com/dashboards

The browser is sent to your project's sign-in page. Sign in as a person assigned to the application. The browser returns to /dashboards, the page you asked for.

What a person experiences

A person opening the service goes through this sequence.

1. They open https://grafana.acme.com/dashboards.
2. With no session, the browser is sent to your project's sign-in page.
3. They sign in, with multi-factor authentication (MFA) if your project requires it.
4. The browser returns to the service, at the page they asked for.
5. They have a session for this service, for the time you chose in Signed-in session lasts.

A person already signed in to your project passes straight through steps 2 to 4.

How the session works

A session is for one service. It is not accepted at another service, so each service is opened only by the people assigned to it.

To end a person's access at once, open Security > Sessions, select their session and choose End session. Suspending the person has the same effect.

Read who is signed in

Every request that reaches your service carries who is making it. Your service reads these headers and needs no token library.

@app.get("/reports")
def reports(request):
    email = request.headers["X-AuthFI-User-Email"]
    groups = request.headers.get("X-AuthFI-Groups", "").split(",")
    if "finance" not in groups:
        return Response(status=403)
    return render_reports(for_user=email)

Any header beginning X-AuthFI- that a caller sends is removed before the request reaches your service. What you read was set by the node, never by the caller.

When an AI agent calls instead of a person, the request also carries X-AuthFI-Agent-ID and X-AuthFI-Agent-Capabilities. It carries X-AuthFI-On-Behalf-Of when the AI agent acts for someone.

Troubleshooting

To remove protection from a service, see Hand a service back.

Next steps