Level Up Your Edge: Do You Know Where Your Traffic Comes From?
summary
Slack implements an Authentication Service at the L7 edge load balancers using L7 edge external auth via Envoy x-oz filter that sends headers and portions of the body to a small gRPC "o service" which inspects token shape and returns gRPC "o service" returns team_id/user_id headers (pass-through mode today). User awareness climbs from ~20% to ~50% to user awareness 90%, edge adds routing, quarantine and per-bot rate limits, and achieves <5 ms P99 latency while planning real token validation next.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:02User traffic management at Slack
- 3:17User-aware traffic management
- 5:45Envoy handling API requests
- 7:34External auth service architecture
- 11:26Request flow to backend services
- 13:13O service token inspection
- 15:23Rollout strategy and awareness
- 18:39Token location standardization
- 21:13Debugging with request headers
- 23:19Latency and P99 performance
- 26:36Handling file uploads
- 27:38Team ownership challenges
- 29:50O service ownership and vision
- 30:1490% user info coverage
- 30:58Next steps for token validation
- 32:03Project timeline and milestones
- 32:47Benefits of user-aware traffic
- 35:41Key takeaways
related talks
36mAdvanced Authentication patterns at the Edge
36mSecuring Every Bit
27mAdvanced Authentication patterns at the Edge
34mInjecting Security at the Cloud Edge
09mBeyond the Login Page: Authentication in Next.js
33mRunning Envoy as an Edge Proxy
27mEnvoy Proxy: Evolved for Serving LLMs
23mMoving application auth to the edge