Empire Access
PricingDocsGet started

Gate any app in one line

Empire Access is a Traefik forwardAuth middleware. Attach it to a router and every request is verified before it reaches the app.

1. Reference the middleware

The gate u7-empire-access-auth already runs. Point any router at it:

http:
  routers:
    my-app:
      rule: "Host(`app.example.com`)"
      middlewares: [u7-empire-access-auth]   # <- the whole integration
      service: my-app-svc

2. What the gate does

Request stateResult
Valid empire_sso cookie200 + X-Empire-User / X-Empire-Owner headers passed to app
No / invalid identity302 → hosted login page, back to original URL after sign-in

3. Harden it (Team & up)

Chain the included WAF-lite middlewares — mined from the retired EmpireCDN nginx+ModSec edge, reborn as Traefik-native:

middlewares: [empire-access-ratelimit, empire-access-secheaders, u7-empire-access-auth]

Get started