• play_circle Get started
    • Overview
    • Architecture
    • Deployment patterns
    • Custom resources
    • Gateway proxies
      • BackendConfigPolicy
      • GlooTrafficPolicy
      • HTTPListenerPolicy
      • Global policy attachment
      • Policy merging
    • Helm
    • ArgoCD
    • Sample app
    • Licensing
    • Advanced
    • Migrate from kgateway
    • Default proxy setup
      • Listener overview
      • HTTP
      • HTTPS
      • SNI
      • TCP
      • TLS passthrough
    • Customize the proxy
    • Horizontal Pod Autoscaling (HPA)
    • HTTP/1.0 and HTTP/0.9
        • Kubernetes services
        • gRPC services
        • Static
          • Overview
          • Access AWS Lambda with a credentials secret
          • Access AWS Lambda with a service account
          • Configure cross-account Lambda access
          • Transform responses
    • Buffering
    • Direct response
    • Dynamic Forward Proxy (DFP)
    • External processing (ExtProc)
      • Overview
      • Request headers
      • Response headers
      • Gateway health checks
      • Backend health checks
    • HTTP2
      • Header
      • Host
      • HTTP method
      • Path
      • Query parameter
      • Host
      • HTTPS
      • Path
      • Host
      • Path
      • Overview
      • Basic example
      • Delegation via labels
      • Multiple parents
      • Multi-level delegation
      • Header and query match
        • Native Gateway API policies
        • Kgateway policies
      • Simple load balancing
      • Consistent hashing
      • Session persistence
    • Traffic splitting
        • About simple transformations
        • Templating language
        • Inject response headers
        • Decode base64 headers
        • Update request paths and methods
        • Create redirect URLs
        • Change response status
        • Update response body
        • About staged transformations
        • Templating language
        • Append headers
        • Extract headers
        • Add headers to body
        • Extract query parameters
        • Update response body
        • Enrich access logs
    • Weighted routing
    • HTTP connection settings
    • Mirroring
    • Outlier detection
      • About
      • Request retries
      • Per-try timeout
    • TCP keepalive
      • About timeouts
      • Request timeouts
      • Idle timeouts
      • Idle stream timeouts
      • Per-try timeouts
    • Access logging
    • Backend TLS
    • CORS
    • CSRF
      • About
      • Basic auth
      • External service
      • API keys
        • About OAuth
        • Access token validation
        • Authorization code
        • More OAuth features
        • Keycloak as an IdP
      • BYO ext auth service
      • Overview
      • Basic JWT policy
      • Provider example
      • About
      • Local rate limiting
        • Envoy API
        • Set-style API
      • BYO global rate limit service
    • About Solo Enterprise for agentgateway
    • Setup
      • About
        • Amazon Bedrock
        • Anthropic
        • Azure OpenAI
        • Gemini
        • OpenAI
        • OpenAI Compatible
        • Vertex
      • Manage API keys
      • Model failover
      • Enrich prompts
      • Set up prompt guards
        • Advanced guardrails
        • Guardrail Webhook API
      • Stream responses
      • Call functions
      • Rate limit AI requests
      • Observe traffic
      • View traces
    • Inference routing
      • About
      • Static MCP
      • Dynamic MCP
      • Connect via HTTPS
      • Secure access to MCP servers
      • Control access to tools
      • About
      • Connect to an agent
    • Configuration
    • CEL-based RBAC
    • Routes
        • Ingress to single cluster mesh
        • Ingress to multicluster mesh
        • Basic ingress
        • Ingress with Gloo Mesh virtual destinations
      • About AWS ELBs in Gloo Gateway
      • AWS NLB
      • AWS ALB
      • Set up the UI
      • Explore the UI
      • Review insights
      • Expose the UI via HTTPS
    • OTel stack
    • Control plane metrics
    • Gateway proxy metrics
    • Debug
    • Upgrade
    • Uninstall
      • Gloo Gateway API
      • Kubernetes Gateway API
      • Kgateway API
      • Gloo Gateway CRDs
      • Gloo Gateway
      • Release notes
      • Gloo Gateway changelog
      • Kgateway changelog
    • Software Bill of Materials (SBOM)
    • Version support
    • Port reference
      • Install the gloo gateway CLI
        • gloo gateway analyze
        • gloo gateway check
        • gloo gateway describe
        • gloo gateway get
      • Visualize resource dependencies
    • About Solo Support
    • Submit a request
    • Solo Enterprise for kgateway
    • 2.1.x (latest)
    • Gloo Gateway (K8s GW API)
    • 2.0.x
    • 1.20.x
    • 1.19.x
    • 1.18.x
    • 1.17.x
    • Gloo Edge
    • 1.20.x
    • 1.19.x
    • 1.18.x
    • 1.17.x
    • GitHub
    • Twitter / X
  • to navigate
  • to select
  • to close
    • Home
    • Security
    On this page

    You are viewing the documentation for the 2.0.x version of Gloo Gateway. To get the latest enterprise features of the Kubernetes Gateway API on top of the kgateway project, see Solo Enterprise for kgateway. To use the older Gloo Gateway 1.x that is based on the Gloo upstream project, click here.

    Security

    Secure your gateway to prevent unauthenticated and unauthorized access to your apps.

    article

    Access logging

    article

    Backend TLS

    article

    CORS

    article

    CSRF

    article

    External authentication and authorization

    article

    JWT

    article

    Rate limiting

    Solo.io copyright 2026