Protecting an entry point means preventing unauthorized access, reducing abuse and limiting the impact of a compromise. Traefik places protections around applications through middlewares and administration settings. This lesson distinguishes their roles and shows how to verify them without confusing a setting that is present with protection that is actually applied.
What you will learn
These objectives distinguish protection for public traffic from measures that reduce exposure of the administration interface and Docker engine.
- Distinguish authentication, source-address filtering and rate limiting.
- Explain what security headers do and where their limits are.
- Keep the API and dashboard behind protected access.
- Reduce the rights given to the Docker provider by isolating socket access.
Prerequisites
This lesson builds on Traefik routing objects and the way the Docker provider discovers containers.
- Traefik: entrypoints, routers, services and middlewares, to locate the router and middleware.
- Publishing containers with the Docker provider, to understand the provider and its socket access.
- HTTPS, covered in Traefik and automatic HTTPS with ACME.
Security in layers
An exposed reverse proxy faces continuous scans, brute-force attempts and rate abuse. No single protection is enough; combine layers.
| Layer | Middleware or setting | Threat addressed |
|---|---|---|
| Authentication | basicAuth, forwardAuth | Unauthorized access |
| Rate | rateLimit | Brute force, application-level denial of service |
| Origin | ipAllowList | Exposure of administration interfaces |
| Response | headers | Clickjacking, XSS, MIME sniffing |
| Transport | TLS | Protecting exchanges between client and proxy |
A measure only applies to the route it is attached to. Check the real request path and observed responses, not just whether an object exists in the configuration.
Authentication
BasicAuth
BasicAuth asks for a username and secret on every request. It can suit a small internal interface when the connection is encrypted. Do not write the secret in clear text to a file tracked by Git. In Docker Compose, special characters in a hash must also be protected from interpolation.
ForwardAuth: delegate to an SSO
ForwardAuth delegates the authentication decision to an external
service. Traefik forwards the request to it and allows access only if the
service returns 2xx. This is how SSO portals such as Authelia or
OAuth2 Proxy can rely on an identity provider such as
Keycloak (in French).
The authentication service makes the decision; the application can then consume explicitly allowed identity headers. Trust those headers only when they come from the expected proxy. Deploying and managing the identity provider is outside this lesson; see Identity management (in French).
| Method | SSO | MFA | Use case |
|---|---|---|---|
| BasicAuth | No | No | Development, internal tools |
| ForwardAuth | Yes | Depends on the identity provider | Production, centralized SSO |
To choose and deploy an identity provider, see the Identity management hub (in French).
Rate limiting
The rateLimit middleware controls request frequency using a grouping source and allows a bounded burst. It can slow abuse against a route, but does not replace network capacity or protection against volumetric denial of service. Set thresholds based on legitimate traffic: a limit that is too low blocks normal users, while one that is too high provides little protection.
IP filtering
ipAllowList restricts access to known address ranges. Use it when an administration interface or back office should be limited to approved networks.
A request whose source address does not match the policy is rejected.
If an upstream proxy sits in front of Traefik, the visible address may
belong to that proxy. Read X-Forwarded-For only from trusted proxies.
Security headers
The headers middleware adds headers that protect the client's browser: anti-clickjacking, anti-MIME-sniffing and content policy.
| Header family | Threat addressed |
|---|---|
| HSTS | Accidental browser return to HTTP |
| Content policy | Unexpected resource or script loading |
| Protection against frame embedding | Deceptive display inside another site |
| Content-type policy | Unexpected interpretation of a response |
| Referrer policy | Excessive disclosure of navigation information |
The right values depend on the application. An overly strict policy can break legitimate resources; check the application's behavior before enforcing a general policy.
CORS
Cross-origin requests are also configured through headers, with
accessControlAllowOriginList, accessControlAllowMethods and
accessControlAllowHeaders. Restrict allowed origins: with *, any
website can read responses to CORS requests without credentials.
CORS does not replace API authentication.
Strengthen TLS options
Beyond certificates, enforce a minimum transport security level. Define
a TLSOption with a minimum TLS 1.2 version and modern cipher suites.
TLS versions and cipher suites are configured separately from middlewares. Choose the minimum based on required compatibility and organizational security policy. For certificate configuration, see Traefik and automatic HTTPS with ACME.
Secure the dashboard
The Traefik dashboard reveals your routing topology. Never expose it
with --api.insecure=true in production. Put it behind a protected route:
HTTPS, plus BasicAuth or ForwardAuth, plus IP filtering.
The dashboard and API expose administrative information. Direct access is only for an isolated local environment. In a deployment, close direct access and make administration available only through an explicitly protected route. Check that the API and dashboard follow the same access policy.
Secure the Docker socket
The Docker socket provides access to the host control API. Mounting it read-only does not make Docker API requests harmless: the mounted file is still a path to the daemon. Use a socket proxy that exposes only the operations Traefik needs and keep it on an internal network. The Docker socket proxy (in French) lesson explains this mechanism.
Production hardening checklist
A security review checks each layer and its effect on a real request. Use the points below as review questions, not as a universal configuration to copy.
-
Encrypt traffic from the client to the entry point and check the behavior of the HTTP redirect.
-
Keep the dashboard closed: never use
insecure; always put it behind authentication and TLS, adding IP filtering when source networks can be restricted. -
Limit the Docker API available to the provider to what it strictly needs.
-
Apply security headers globally on public entrypoints.
-
Use rate limiting and IP filtering on sensitive routes (administration, API).
-
Follow product security advisories and review changes during upgrades.
Troubleshooting
A symptom suggests which layer to examine first. Confirm the hypothesis with the actual response and logs before changing a setting.
| Symptom | Likely cause | Fix |
|---|---|---|
| HSTS is absent | Testing over HTTP | HSTS is sent only over HTTPS |
| A legitimate user is blocked | Rate threshold is too strict | Compare it with normal load before changing the policy |
| Unexpected source address | Traefik receives a connection from an upstream proxy | Declare trusted proxies explicitly before reading forwarded headers |
Practice
The lab asks you to reduce exposure of an administration endpoint and the Docker provider, then check behavior from an authorized and an unauthorized client. The scenario supplies the environment details and success criteria; this lesson explains the risks and protection families without giving you a ready-to-copy configuration.
Key points
These controls complement each other: security depends on their actual application, not just their presence in a file.
- Traefik protects services with complementary layers but does not replace application controls.
- BasicAuth suits restricted use; ForwardAuth delegates a decision to an identity service.
- Adapt filtering and rate limits to the source and legitimate traffic.
- Headers strengthen browser behavior; HSTS applies to an HTTPS connection.
- Do not expose the dashboard without protection or mount the raw Docker socket.
Knowledge check
The quiz covers the role and limits of the main protections.
Knowledge check
Check what you have learned with this interactive quiz
How it works
- The timer starts when you click Start
- Multiple choice, true/false and short answer questions
- You can move between questions
- Detailed results are shown at the end
Starts the quiz and the timer
Review
(0/0)Score by domain
A domain groups several guides and gets several questions, so its score is more reliable than a per-topic score, which often rests on a single question.
Summary
Strengths
No topic passed at 80% on at least two questions yet.
Weak areas
No topic below the pass mark.
Recommended next
Hints before you try again?
Continue the course: Verify client and backend identities with Traefik
A new full quiz with random questions
Work again only on the questions you missed