Authenticated Proxy
You set up an authenticated proxy by routing traffic through a login check first. This setup checks user identity before any request reaches your private server. Most teams link this network node to their central single sign-on provider. They map directory groups to broad server roles for fast daily work. Still, broad roles often give one user too much power across many systems. How an authenticated proxy works in your network A standard network relay sits between external users and your priv
Database Proxy (ProxySQL, PgBouncer): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up an authenticated proxy by routing traffic through a login check first. This setup checks user identity before any request reaches your private server. Most teams link this network node to their central single sign-on provider. They map directory groups to broad server roles for fast daily work. Still, broad roles often give one user too much power across many systems.
How an authenticated proxy works in your network
A standard network relay sits between external users and your private backend systems. When a user sends a request, the relay stops the traffic right away. It checks if the user has a valid session token from your login provider. If the user has no token, the system sends them to a login page. The user enters their password and completes a second factor check there.
Once the login provider confirms the user, it sends back a signed token. The relay reads this token to check the user identity and group name. Next, it compares that group against a local list of allowed routes. If the group matches the rule, the relay forwards the traffic to the server. If the group does not match, the relay drops the request right away.
Teams also use this pattern for outbound traffic from internal apps. In that case, an app sends a username and password with its outbound call. The relay checks those details before sending the request out to the internet. Both inbound and outbound flows rely on checking identity at the network edge.
What native login checks solve and what they miss
This edge setup solves a major problem for growing tech teams. You do not need to build login screens into every single internal tool. Legacy web apps and admin panels get a single sign-on wall in front. You also keep private servers off the public internet to block outside scans. When someone leaves the team, you disable their main account in one place.
Yet this network check only decides who can open the front door. Once the session starts, the edge node stops checking what the user does. A developer with a valid token can run any query or delete tables. An admin can read sensitive customer rows with full emails and card numbers. Native network checks do not inspect database queries or shell commands in flight.
Database Proxy (ProxySQL, PgBouncer): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Standard logs also miss the real details of what happened inside the session. You might see that a user opened a connection at nine in the morning. You will not see which specific commands they ran inside that open tunnel. Also, users still need separate database passwords or keys after passing the edge check. Sharing those static keys across the team creates a big risk for your data.
Steps to keep network routing clean and safe
Start by linking your edge node to one central identity provider for everyone. Require multi-factor checks on every login attempt before granting any network token. Keep session lifetimes short so old tokens expire after a few hours of work. Never allow shared group accounts to pass through your login check.
Next, split your routing rules by job need instead of giving full network access. A support agent should only reach the billing web tool, not the database port. Review your group mappings every month to remove old rules that nobody uses. Finally, look at how you control actions after the initial network login finishes.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between a public relay and an authenticated one?
A public relay forwards traffic from any source without checking who sent it. An authenticated setup requires a valid user login or token before forwarding any request.
Does an edge login check replace database permissions?
No, the edge check only controls who can reach the database network port. You still need database roles and query rules to control what users read or write.
How does single sign-on work with network routing?
The routing node redirects new users to your main identity provider to log in. After login, the provider gives the user a signed token to pass the node.