What is nforwardauth?

nforwardauth is a minimalist forward authentication service written in Rust that sits between a reverse proxy and protected applications. It authenticates users via a passwd file with SHA-512 hashed credentials and issues signed tokens stored in cookies. Once authenticated, users can access all protected services without re-entering credentials. It supports Traefik, Caddy, and nginx as reverse proxies, includes a built-in rate limiter for login attempts, and can pass the authenticated username to downstream services via the X-Forwarded-User header. The service is configured entirely through environment variables and requires only a passwd file volume mount. It has no external database dependencies.

Should you self-host nforwardauth?

nforwardauth scores 44/100 on selfhost.directory (how scoring works) and ranks #28 of 40 in Authentication. It has 159 GitHub stars.

It shipped 1 stable release in the past year. The latest, v1.5.1, came out on 10 July 2026.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Rust.

Its closest alternative on selfhost.directory is keycloak (86/100, 37 571 stars). It scores higher overall, so compare the two before you pick. See nforwardauth vs keycloak side by side.