Authelia provides authentication and authorization in front of applications through a web portal and forwarded authentication. A portal login page can appear on a public hostname while the applications behind it are protected by separate access-control rules. That makes the portal itself a less useful indicator of exposure than the route policy behind it.
ZoomEye count-only queries on 2026-10-30 returned zero matches for app="Authelia" and 11,776 for title="Authelia" between 06:41 and 06:42 China Standard Time. The title may include documentation, login pages, or reverse-proxy error pages. The result does not show which applications are protected, which users can authenticate, or whether a rule permits an unauthenticated route.
Keep proxy trust inside the identity path
Authelia's forwarded-auth flow checks request metadata and a session cookie. A reverse proxy passes the identity or authorization result to the application. If any client can reach the application directly, or can set the headers normally added by the proxy, the application may accept an unauthenticated request. Strip client-supplied proxy headers at the edge and firewall the application port so only the proxy can reach it.
The access-control rule should specify the domain, path, and policy. A broad bypass rule for health checks or static assets can accidentally cover an administrative path if the path matching is broader than intended. Test exact paths, prefixes, URL-encoded paths, trailing slashes, and case variations. A redirect from an unauthenticated request should not reveal a protected page body before the redirect completes.
Use a policy that matches the operation. A portal that requires a password for one route and a passkey for another should have those rules in the same reviewed configuration. The source documentation describes rules that can require different authentication levels for different resources. Map groups to resources explicitly and avoid a default that permits everything when no rule matches.
Review session and identity-provider revocation
Authelia stores sessions and can act as an identity provider. A user who is removed from a group may retain an existing session until it expires or is revoked. Test group removal and identity-provider logout with a protected application. If the application caches its own authorization result, confirm that the cache has a bounded lifetime or a revocation path.
OIDC bearer-token use is different from a browser cookie. The token must be accepted only where the client and scope were intended. Review token audience, issuer, and lifetime. A bearer token that is accepted by the wrong proxy path can turn a narrow integration into a broad access grant. Do not accept a token merely because its signature is valid.
Passwords and passkeys need recovery rules. A recovery path that bypasses the second factor may be the weakest link. Restrict who can reset an account and require an out-of-band identity check. Record recovery actions, and alert on repeated failures or a reset immediately followed by access to sensitive routes.
Test from the application side
For an owned title match, confirm the portal URL and deployment owner, then test a protected application directly and through the proxy. Send a request with a forged Remote-User, Remote-Groups, or equivalent header. It should fail when it bypasses the proxy. Repeat with a valid session and a removed user. Confirm that the application rejects an expired session even if the portal still renders.
Check the portal domain for an exposed API or configuration endpoint. A login page does not justify exposing the full management interface. Put administrator endpoints on a separate network or require a stronger policy, and review logs for the source address and authenticated identity.
The 11,776 title matches are not a vulnerability count. Authelia's security value comes from the coupling between the identity portal, the trusted proxy, and the application route. Test that coupling with concrete requests instead of treating the presence of a portal as proof that every route is protected.
Query and scope
The standalone SDK used sub_type=all, page 1, and page size 1. app="Authelia" returned zero and title="Authelia" returned 11,776. Collection ran from 2026-10-29 22:41:49 to 22:41:52 UTC.