Traefik operates as a dynamic reverse proxy and load balancer where developers must explicitly configure security boundaries, protocol hardening, and authentication controls. The library handles routing, TLS termination, and traffic distribution by default, but it does not inherently prevent misconfigurations such as unrestricted source IPs, missing rate limits, or exposed administrative endpoints. Critical attack surfaces include entrypoints, middleware chains, credential stores, and dynamic configuration providers. All security controls, including rate limits, authentication verification, and fail-closed storage backends, must fail closed upon failure.
Essential implementation rules
Enforce Role-Based Access Control and Token Validation
Configure claims expressions in OAuth2 and JWT middleware to verify authorized roles and scopes. Pass JWT tokens securely through standard Authorization header configurations rather than query parameters or form data.
Restrict Network Exposure and Source IP Allowlists
Implement explicit source IP CIDR ranges using ipAllowList middlewares or ipAllowList fields in MiddlewareTCP resources. Define separate privateEntrypoints and publicEntrypoints and explicitly set entryPoints on all HTTP routers and IngressRoute resources to prevent exposing internal services on public interfaces.
Secure Credentials and Load Sensitive Secrets via URNs
Store BasicAuth credentials using secure BCrypt hashes with properly escaped dollar signs in container labels, and use htdigest format for DigestAuth. Reference external secrets using urn:k8s:secret:<secret-name>:<key> syntax in middleware CRDs instead of embedding plaintext credentials in manifests, and avoid putting sensitive data in container labels or service tags.
Enforce Strict Mutual TLS and Certificate Verification
Set clientAuth.clientAuthType to RequireAndVerifyClientCert and specify trusted CAs using caFiles or Kubernetes secretNames. Keep disableIssuerCheck and clientConfig.tls.insecureSkipVerify disabled in production environments.
Enforce Namespace and Cross-Provider Boundary Restrictions
Explicitly scope provider discovery using namespace filtering flags and configure crossProviderNamespaces in static configuration to prevent unauthorized cross-namespace resource references. Set allowExternalNameServices to false to block routing to external CNAME records and prevent server-side request forgery.
Secure Key-Value Store Backends and Configuration Sources
Restrict write access to root key prefixes using KV backend ACLs and authenticated TLS connections. Ensure Traefik runs with read-only permissions on backend providers and exclude reserved symbols like @ from router and service names in KV configuration keys.
Configure Robust Cryptographic Key Types for ACME
Explicitly set keyType to a strong algorithm option such as EC256, EC384, or RSA4096 when configuring ACME certificate resolvers to ensure generated private keys have adequate cryptographic strength.
Disable Snippet Annotations and Enforce Path Sanitization
Keep allowSnippetAnnotations set to false in Ingress NGINX provider settings to prevent directive injection. Enable sanitizePath: true under HTTP entrypoints to neutralize relative directory traversal attempts, and keep encoded path flags set to false in encodedCharacters middleware unless strictly required.
Enforce Protocol Upgrades, Header Validation, and Proxy Trust
Configure automatic protocol upgrades from HTTP to HTTPS using entrypoint redirections or redirectscheme middleware. Set underscoreHeadersStrategy to delete or reject on entrypoints, enable sniStrict: true for TLS options, and explicitly define trusted client proxy sources using forwardedHeaders.trustedIPs while keeping forwardedHeaders.insecure disabled.
Bound Retries, Timeouts, Request Bodies, and Rate Limits
Configure finite limits for retry attempts, timeout durations, and maxRequestBodyBytes to prevent memory exhaustion and request amplification storms. Set explicit forwarding timeouts on server transports, enforce non-zero rate limits on rate-limiting middleware, and configure maximum request and response body size limits on buffering middlewares.
Harden Container Runtime and Validate Plugin Trust Boundaries
Run containers with no-new-privileges:true and connect to an authorized-docker-api-proxy. Enforce strict least-privilege filesystem boundaries for WASM plugins with :ro mount suffixes, specify fully qualified module names and explicit versions, keep useUnsafe set to false for Go plugins, and enforce hash verification when installing external plugins.
Redact Sensitive Log Data and Secure Session Cookies
Configure header and query parameter filtering in access logs to drop or redact sensitive authorization details, and set removeHeader: true on authentication middlewares to prevent forwarding Authorization headers to backends. Explicitly set secure: true and httpOnly: true flags on session and sticky session cookies.
Enforce Fail-Closed Behavior and Correct Control Ordering
Maintain denyOnError: true on distributed rate-limiting middleware so requests fail closed when storage backends are unreachable. Attach security-critical middlewares to routers or services in their correct execution order, and maintain at most one TLSOption resource named default to prevent fallback degradation.
traefik: All Security Cards
Approximately 6,195 tokens
On this card
Category: access control
Enforce Role-Based Access Control and Token Claim Validation
Use when
When configuring authentication and authorization middleware to evaluate token claims and enforce role or scope constraints before forwarding requests to backend services.
Secure rules
Rule 1: Enforce attribute and role-based access control by validating specific token claims
In Traefik Hub, configure claims expressions within OAuth2 or JWT middleware configurations to verify that authenticated tokens contain authorized roles, groups, or scopes before allowing access to protected routes.
Restrict Route and Service Exposure Using Source IP Allowlists and Network Scoping
Use when
When configuring network access controls, source IP restrictions, and namespace boundary limits to prevent unauthorized external access or cross-provider resource exposure in Traefik.
Secure rules
Rule 1: Restrict incoming route and service access using explicit source IP ranges and allowlist middlewares
Implement network access control by defining source IP CIDR ranges within ipAllowList middleware resources or ipAllowList fields in MiddlewareTCP resources, ensuring external traffic is limited to trusted networks.
Rule 2: Limit cross-provider namespace references to prevent unauthorized internal service exposure.
Explicitly configure crossProviderNamespaces in static configuration to restrict which Kubernetes namespaces are permitted to declare cross-provider references or bind to internal services.
Configure and Verify Credentials for Basic, Digest, and API Key Authentication
Use when
Use when defining static or dynamic user credentials, hashed passwords, or token keys for BasicAuth, DigestAuth, or API Key middleware configurations.
Secure rules
Rule 1: Store credentials using secure password hashes and configure hash escaping properly in container labels
Always store BCrypt password hashes instead of plain text when defining authorized users in BasicAuth configurations. In Docker labels, dollar signs in password hashes must be escaped as double dollar signs to prevent environment variable expansion.
Rule 2: Use htdigest formatted passwords for DigestAuth middleware configurations.
When configuring the DigestAuth middleware, supply user credentials using the username, realm, and encoded-password format generated by htdigest rather than plaintext password strings.
Rule 3: Pass JWT tokens securely through authorization headers rather than query parameters
For Traefik Hub’s JWT middleware, avoid configuring tokenKey to pass JWTs via query parameters or form data when standard Authorization headers can be used, and leave tokenKey empty to ensure clients pass JWT tokens in the Authorization Bearer HTTP header.
Enforce Mutual TLS and Client Certificate Verification
Use when
Use when setting up mutual TLS, entrypoint certificate validation, or forwarding client certificate data to backend services.
Secure rules
Rule 1: Enforce strict client certificate verification modes and specify trusted CA files.
When configuring mutual TLS in Traefik, set clientAuth.clientAuthType to RequireAndVerifyClientCert and specify trusted CAs using caFiles or Kubernetes secretNames to prevent unauthenticated connections.
Rule 2: Configure mutual TLS with explicit client authentication policies when forwarding client certificate data.
When using passTLSClientCert to forward client certificate data to backend services, ensure that Mutual TLS is properly configured with an explicit clientAuth.clientAuthType policy.
Validate Issuer and Enable TLS Verification for External Authentication Providers
Use when
Use when configuring OIDC, ForwardAuth, or LDAP authentication middleware and providers.
Secure rules
Rule 1: Enforce issuer checks and TLS certificate validation for OIDC and forward authentication services
For Traefik Hub OIDC, keep disableIssuerCheck and clientConfig.tls.insecureSkipVerify false in production; for ForwardAuth, keep tls.insecureSkipVerify false.
Rule 2: Specify bindDN and bindPassword when running LDAP middleware in search mode
For Traefik Hub’s LDAP middleware, when searchFilter is defined to run it in search mode, always explicitly specify bindDN and bindPassword to avoid anonymous binds.
Enforce Namespace and Cross-Provider Boundary Restrictions for Kubernetes Providers
Use when
When configuring Traefik Kubernetes Ingress, CRD, and Gateway providers to isolate tenant boundaries and prevent unauthorized resource discovery or cross-namespace references.
Secure rules
Rule 1: Restrict provider resource discovery and cross-namespace references.
Explicitly scope provider discovery using namespace filtering flags and disable cross-namespace resource access to maintain proper tenant boundaries and prevent resource hijacking.
Secure Key-Value Store Configuration Backend Access Controls
Use when
Configuring key-value stores such as Consul, Etcd, Redis, or ZooKeeper as dynamic configuration providers for Traefik.
Secure rules
Rule 1: Restrict write access and use authenticated TLS connections for key-value store providers.
Strictly restrict write access to the root key prefix using KV backend ACLs and authentication. Ensure Traefik runs with read-only permissions on the backend where supported, and avoid allowing untrusted network clients to modify KV store entries.
Configure Cryptographic Key Types for ACME Certificate Generation
Use when
Configuring ACME certificate resolvers to issue TLS certificates with appropriate cryptographic key strengths.
Secure rules
Rule 1: Specify robust cryptographic key types using the keyType parameter.
When configuring ACME certificate resolvers in Traefik, explicitly set keyType to a strong algorithm option such as EC256, EC384, or RSA4096 to ensure generated private keys offer adequate cryptographic resistance.
Disable raw snippet annotations to restrict directive injection
Use when
Configuring the Traefik Ingress NGINX provider where untrusted ingress authors might supply custom metadata annotations.
Secure rules
Rule 1: Keep allowSnippetAnnotations set to false to prevent execution of unvalidated raw directive injections.
Ensure snippet annotations remain disabled in your Traefik ingress-nginx provider settings to prevent escape hatch risks where users could override proxy logic or tamper with security controls.
Enforce valid naming syntax for router and service keys
Use when
Configuring router and service names in key-value stores to ensure compliance with expected naming syntax and prevent syntax misuse.
Secure rules
Rule 1: Exclude reserved symbols from router and service names
Do not include the @ character within router names or service names when creating KV configuration keys. The @ character is reserved by Traefik to delimit resource names from provider namespaces. Use alphanumeric names separated by hyphens instead.
consul kv put traefik/http/routers/web-router/rule "Host(`example.com`)"consul kv put traefik/http/routers/web-router/service "web-service"
Category: input interpretation safety
Enable Path Sanitization on EntryPoints to Prevent Traversal Attacks
Use when
Configuring HTTP entrypoints to protect static file servers and downstream backends from relative directory traversal attempts.
Secure rules
Rule 1: Enforce sanitizePath: true under the HTTP configuration of all entryPoints.
Traefik normalizes request paths by removing duplicate slashes and resolving dot segments like .. and . before forwarding requests. Ensure path sanitization is explicitly enabled on entrypoints to neutralize relative directory traversal attempts.
Restrict Encoded Path Characters to Prevent Parsing Discrepancies and Bypasses
Use when
Configuring Traefik router paths and handling URL-encoded request characters to ensure consistent path interpretation between proxies and upstream services.
Secure rules
Rule 1: Restrict encoded path characters in router rules to prevent path normalization discrepancies
Keep flags such as allowEncodedSlash, allowEncodedBackSlash, and allowEncodedNullCharacter set to false in an encodedCharacters middleware attached to the router unless an upstream service explicitly requires them and has strict path handling controls in place.
Configure Automatic HTTP to HTTPS EntryPoint and Service Redirections
Use when
Setting up entryPoints or dynamic routing configurations where unencrypted traffic must be automatically redirected to secure HTTPS endpoints.
Secure rules
Rule 1: Enforce automatic protocol upgrading by configuring entryPoint-level or middleware-based HTTP to HTTPS redirections
In your Traefik static configuration, set http.redirections.entryPoint.to on unencrypted entryPoints like port 80 to point to a TLS-enabled entryPoint with scheme: https and permanent: true. For dynamic providers like Consul Catalog or Nomad, attach a redirectscheme middleware configured with scheme=https to your HTTP routers using service tags to redirect clients to HTTPS after the initial plaintext request.
Enforce Strict Protocol and Header Validation on EntryPoints
Use when
Configuring entrypoints and routing rules to prevent request smuggling, header pollution, and protocol confusion attacks.
Secure rules
Rule 1: Configure the underscore headers strategy to delete or reject ambiguous headers.
Set underscoreHeadersStrategy to delete or reject on entrypoints rather than keeping the default keep setting to prevent header pollution and environment variable injection attacks against backend services.
Rule 2: Enable strict SNI checking to reject requests with invalid or missing server names.
Configure sniStrict: true in TLS options so Traefik explicitly rejects connections from clients that do not supply a Server Name Indication header or attempt to connect to a domain that does not match any configured certificate.
tls: options: default: sniStrict: true
Category: network boundary
Enforce Strict Entrypoint and Network Boundary Restrictions
Use when
Defining routers, ingress routes, and provider bindings that expose backend services across network interfaces.
Secure rules
Rule 1: Configure distinct private and public entrypoints when using providers such as Knative to prevent public exposure of internal services.
Define separate privateEntrypoints and publicEntrypoints in your provider configuration. Routes marked cluster-local should map exclusively to private entrypoints to ensure internal management APIs are not accidentally exposed to the public internet.
Rule 2: Explicitly restrict entrypoints on IngressRoute and HTTP routers instead of relying on defaults that bind to all interfaces.
Always explicitly define the entryPoints field for every HTTP router and IngressRoute resource. Omitting this field causes Traefik to attach the router to all configured entry points by default, potentially exposing internal routes on unencrypted or public networks.
Restrict Forwarded Headers and External Name Resolutions
Use when
Configuring entrypoints and providers in Traefik to handle incoming proxy headers and internal service routing boundaries.
Secure rules
Rule 1: Explicitly define trusted client proxy sources using forwardedHeaders.trustedIPs and keep forwardedHeaders.insecure disabled.
Never enable forwardedHeaders.insecure: true in production environments because it trusts incoming X-Forwarded-* headers blindly. Always specify trusted IP addresses or CIDR blocks using forwardedHeaders.trustedIPs to prevent IP spoofing and bypasses of rate-limiting or authentication controls.
Rule 2: Disable allowExternalNameServices in Kubernetes CRD and Ingress providers to prevent server-side request forgery.
Ensure allowExternalNameServices is set to false in the Traefik static configuration to stop Traefik from routing traffic to external CNAME DNS records. This prevents attackers from forcing proxy traffic to internal cloud metadata endpoints or internal infrastructure.
Configure Bounded Retries, Timeouts, and Health Checks
Use when
Configuring load balancing retries, upstream timeouts, active/passive health checks, and circuit breakers for backend services.
Secure rules
Rule 1: Set explicit bounds on retry attempts, timeout durations, and maximum request body bytes.
Configure finite limits for attempts, timeout, and maxRequestBodyBytes to prevent memory exhaustion from request body buffering and request amplification storms. Avoid setting maxRequestBodyBytes to -1 and keep retryNonIdempotentMethod disabled unless upstream services explicitly support safe idempotent execution.
Rule 2: Define explicit backend forwarding timeouts and health check timeout thresholds
Specify explicit forwarding timeouts (dialTimeout, responseHeaderTimeout, idleConnTimeout) on servers transports and set healthCheck.timeout on load balancer services to prevent hanging connections and dead backends from consuming proxy resources.
Enforce Request Body Size and Rate Limits to Prevent Resource Exhaustion
Use when
When configuring Traefik middlewares or backend services to handle incoming HTTP requests and prevent resource starvation caused by unbounded request payloads or client request rates.
Secure rules
Rule 1: Configure explicit maximum request and response body size limits on buffering and forwarding middlewares
Set maxRequestBodyBytes and maxResponseBodyBytes on Buffering, and maxBodySize and maxResponseBodySize on ForwardAuth when it forwards bodies, to finite limits rather than leaving them unlimited.
Rule 2: Enforce non-zero rate limits on rate-limiting middleware configurations.
Ensure the average parameter is configured with a non-zero request rate when enabling the rateLimit middleware to prevent turning off rate limiting entirely.
Harden Container Runtime with Restricted Docker API Access and Privilege Restrictions
Use when
Configuring container deployment for Traefik to run with least privilege and reduced attack surface.
Secure rules
Rule 1: Restrict Docker API access and enforce privilege restrictions
Do not rely on a read-only Docker socket mount to restrict Docker API operations. Connect Traefik to an authorization-filtering Docker API proxy, and configure no-new-privileges:true to limit privilege escalation.
Secure and Validate Traefik Plugins and Module Trust Boundaries
Use when
Configuring, installing, or executing third-party and custom Go or WebAssembly plugins within Traefik.
Secure rules
Rule 1: Restrict WASM plugin filesystem access with read-only mounts
Enforce strict least-privilege filesystem boundaries by appending the :ro suffix to host directory mounts in WASM plugin settings where write access is not required.
Rule 4: Restrict WebAssembly plugin module paths to local directories
Ensure manifest configuration references strictly local paths relative to the plugin directory and avoids absolute paths or directory traversal sequences.
{ "wasmPath": "bin/plugin.wasm"}
Rule 5: Limit environment variable exposure to WASM plugin instances
Restrict Settings.Envs to public or non-sensitive configuration keys required by the WASM module, avoiding process-level host secrets or API tokens.
Rule 6: Enforce hash verification when installing external plugins
Always define and enforce expected module hashes when installing external plugins to ensure packages are validated against configured descriptors before extraction.
Avoid Storing Sensitive Data in Container Labels and Service Tags
Use when
Defining routing rules and service metadata for orchestrator providers like Docker, Swarm, ECS, Consul, and Nomad.
Secure rules
Rule 1: Do not embed credentials, tokens, or private keys inside container labels or service tags.
Container metadata and service discovery tags are exposed in plain text through API endpoints, inspection commands, and monitoring tools. Store sensitive configuration in dedicated secret stores, file-based providers, or secure storage systems instead of container labels or Consul/Nomad service tags.
Rule 1: Drop or redact sensitive authentication headers and query parameters from access logs, and remove authentication headers from backend requests
Configure header and query parameter filtering in Traefik access logs to explicitly drop or redact sensitive authorization details. When using BasicAuth or DigestAuth, explicitly set removeHeader to true to prevent forwarding the Authorization header to backend services.
accessLog: format: json fields: headers: defaultMode: drop names: Authorization: drop User-Agent: redact queryParameters: defaultMode: drop
Category: security control integrity
Enforce Fail-Closed Behavior and Correct Ordering for Security Controls
Use when
Configuring security middleware, rate limiting backends, or TLS default options where failure handling and execution order must prevent security control bypass or degradation.
Secure rules
Rule 1: Keep denyOnError enabled to ensure requests fail closed when storage backends are unavailable
For Traefik Hub’s Distributed RateLimit middleware, maintain denyOnError set to true so that incoming requests fail closed when the Redis storage backend becomes unreachable, preventing rate limiting bypass.
Rule 2: Apply security middlewares at the required trust boundary and preserve execution order
Attach security-critical middlewares to every applicable router or to the service when all routers using it must be protected; router-level middlewares run before service-level middlewares, and each list runs in declaration order.
Rule 3: Maintain a single cluster-wide default TLS option to prevent fallback degradation
Maintain at most one TLSOption resource named default across all namespaces to prevent duplicate resources from being dropped and Traefik’s internal default TLS options from being used.
Configure Secure and HttpOnly Attributes for Session and Sticky Cookies
Use when
Configuring session or sticky session cookies across Traefik routing, middleware, and backend service configurations to protect tokens from interception and client-side script theft.
Secure rules
Rule 1: Explicitly set Secure and HttpOnly flags on session and sticky session cookies.
When configuring session identifiers or load balancer sticky session cookies, you must explicitly enable security flags such as secure: true and httpOnly: true along with strict sameSite attributes. Omitting these settings exposes session tokens to network eavesdropping over cleartext HTTP and client-side extraction through Cross-Site Scripting (XSS) vulnerabilities.
Enforce Role-Based Access Control and Token Claim Validation
Approximately 488 tokens
Use when
When configuring authentication and authorization middleware to evaluate token claims and enforce role or scope constraints before forwarding requests to backend services.
Secure rules
Rule 1: Enforce attribute and role-based access control by validating specific token claims
In Traefik Hub, configure claims expressions within OAuth2 or JWT middleware configurations to verify that authenticated tokens contain authorized roles, groups, or scopes before allowing access to protected routes.
Restrict Route and Service Exposure Using Source IP Allowlists and Network Scoping
Use when
When configuring network access controls, source IP restrictions, and namespace boundary limits to prevent unauthorized external access or cross-provider resource exposure in Traefik.
Secure rules
Rule 1: Restrict incoming route and service access using explicit source IP ranges and allowlist middlewares
Implement network access control by defining source IP CIDR ranges within ipAllowList middleware resources or ipAllowList fields in MiddlewareTCP resources, ensuring external traffic is limited to trusted networks.
Rule 2: Limit cross-provider namespace references to prevent unauthorized internal service exposure.
Explicitly configure crossProviderNamespaces in static configuration to restrict which Kubernetes namespaces are permitted to declare cross-provider references or bind to internal services.
Configure and Verify Credentials for Basic, Digest, and API Key Authentication
Approximately 955 tokens
Use when
Use when defining static or dynamic user credentials, hashed passwords, or token keys for BasicAuth, DigestAuth, or API Key middleware configurations.
Secure rules
Rule 1: Store credentials using secure password hashes and configure hash escaping properly in container labels
Always store BCrypt password hashes instead of plain text when defining authorized users in BasicAuth configurations. In Docker labels, dollar signs in password hashes must be escaped as double dollar signs to prevent environment variable expansion.
Rule 2: Use htdigest formatted passwords for DigestAuth middleware configurations.
When configuring the DigestAuth middleware, supply user credentials using the username, realm, and encoded-password format generated by htdigest rather than plaintext password strings.
Rule 3: Pass JWT tokens securely through authorization headers rather than query parameters
For Traefik Hub’s JWT middleware, avoid configuring tokenKey to pass JWTs via query parameters or form data when standard Authorization headers can be used, and leave tokenKey empty to ensure clients pass JWT tokens in the Authorization Bearer HTTP header.
Enforce Mutual TLS and Client Certificate Verification
Use when
Use when setting up mutual TLS, entrypoint certificate validation, or forwarding client certificate data to backend services.
Secure rules
Rule 1: Enforce strict client certificate verification modes and specify trusted CA files.
When configuring mutual TLS in Traefik, set clientAuth.clientAuthType to RequireAndVerifyClientCert and specify trusted CAs using caFiles or Kubernetes secretNames to prevent unauthenticated connections.
Rule 2: Configure mutual TLS with explicit client authentication policies when forwarding client certificate data.
When using passTLSClientCert to forward client certificate data to backend services, ensure that Mutual TLS is properly configured with an explicit clientAuth.clientAuthType policy.
Validate Issuer and Enable TLS Verification for External Authentication Providers
Use when
Use when configuring OIDC, ForwardAuth, or LDAP authentication middleware and providers.
Secure rules
Rule 1: Enforce issuer checks and TLS certificate validation for OIDC and forward authentication services
For Traefik Hub OIDC, keep disableIssuerCheck and clientConfig.tls.insecureSkipVerify false in production; for ForwardAuth, keep tls.insecureSkipVerify false.
Rule 2: Specify bindDN and bindPassword when running LDAP middleware in search mode
For Traefik Hub’s LDAP middleware, when searchFilter is defined to run it in search mode, always explicitly specify bindDN and bindPassword to avoid anonymous binds.
Enforce Namespace and Cross-Provider Boundary Restrictions for Kubernetes Providers
Approximately 186 tokens
Use when
When configuring Traefik Kubernetes Ingress, CRD, and Gateway providers to isolate tenant boundaries and prevent unauthorized resource discovery or cross-namespace references.
Secure rules
Rule 1: Restrict provider resource discovery and cross-namespace references.
Explicitly scope provider discovery using namespace filtering flags and disable cross-namespace resource access to maintain proper tenant boundaries and prevent resource hijacking.
Secure Key-Value Store Configuration Backend Access Controls
Approximately 233 tokens
Use when
Configuring key-value stores such as Consul, Etcd, Redis, or ZooKeeper as dynamic configuration providers for Traefik.
Secure rules
Rule 1: Restrict write access and use authenticated TLS connections for key-value store providers.
Strictly restrict write access to the root key prefix using KV backend ACLs and authentication. Ensure Traefik runs with read-only permissions on the backend where supported, and avoid allowing untrusted network clients to modify KV store entries.
Configure Cryptographic Key Types for ACME Certificate Generation
Approximately 198 tokens
Use when
Configuring ACME certificate resolvers to issue TLS certificates with appropriate cryptographic key strengths.
Secure rules
Rule 1: Specify robust cryptographic key types using the keyType parameter.
When configuring ACME certificate resolvers in Traefik, explicitly set keyType to a strong algorithm option such as EC256, EC384, or RSA4096 to ensure generated private keys offer adequate cryptographic resistance.
Disable raw snippet annotations to restrict directive injection
Approximately 158 tokens
Use when
Configuring the Traefik Ingress NGINX provider where untrusted ingress authors might supply custom metadata annotations.
Secure rules
Rule 1: Keep allowSnippetAnnotations set to false to prevent execution of unvalidated raw directive injections.
Ensure snippet annotations remain disabled in your Traefik ingress-nginx provider settings to prevent escape hatch risks where users could override proxy logic or tamper with security controls.
Enforce valid naming syntax for router and service keys
Approximately 188 tokens
Use when
Configuring router and service names in key-value stores to ensure compliance with expected naming syntax and prevent syntax misuse.
Secure rules
Rule 1: Exclude reserved symbols from router and service names
Do not include the @ character within router names or service names when creating KV configuration keys. The @ character is reserved by Traefik to delimit resource names from provider namespaces. Use alphanumeric names separated by hyphens instead.
consul kv put traefik/http/routers/web-router/rule "Host(`example.com`)"consul kv put traefik/http/routers/web-router/service "web-service"
Enable Path Sanitization on EntryPoints to Prevent Traversal Attacks
Approximately 387 tokens
Use when
Configuring HTTP entrypoints to protect static file servers and downstream backends from relative directory traversal attempts.
Secure rules
Rule 1: Enforce sanitizePath: true under the HTTP configuration of all entryPoints.
Traefik normalizes request paths by removing duplicate slashes and resolving dot segments like .. and . before forwarding requests. Ensure path sanitization is explicitly enabled on entrypoints to neutralize relative directory traversal attempts.
Restrict Encoded Path Characters to Prevent Parsing Discrepancies and Bypasses
Use when
Configuring Traefik router paths and handling URL-encoded request characters to ensure consistent path interpretation between proxies and upstream services.
Secure rules
Rule 1: Restrict encoded path characters in router rules to prevent path normalization discrepancies
Keep flags such as allowEncodedSlash, allowEncodedBackSlash, and allowEncodedNullCharacter set to false in an encodedCharacters middleware attached to the router unless an upstream service explicitly requires them and has strict path handling controls in place.
Configure Automatic HTTP to HTTPS EntryPoint and Service Redirections
Approximately 469 tokens
Use when
Setting up entryPoints or dynamic routing configurations where unencrypted traffic must be automatically redirected to secure HTTPS endpoints.
Secure rules
Rule 1: Enforce automatic protocol upgrading by configuring entryPoint-level or middleware-based HTTP to HTTPS redirections
In your Traefik static configuration, set http.redirections.entryPoint.to on unencrypted entryPoints like port 80 to point to a TLS-enabled entryPoint with scheme: https and permanent: true. For dynamic providers like Consul Catalog or Nomad, attach a redirectscheme middleware configured with scheme=https to your HTTP routers using service tags to redirect clients to HTTPS after the initial plaintext request.
Enforce Strict Protocol and Header Validation on EntryPoints
Use when
Configuring entrypoints and routing rules to prevent request smuggling, header pollution, and protocol confusion attacks.
Secure rules
Rule 1: Configure the underscore headers strategy to delete or reject ambiguous headers.
Set underscoreHeadersStrategy to delete or reject on entrypoints rather than keeping the default keep setting to prevent header pollution and environment variable injection attacks against backend services.
Rule 2: Enable strict SNI checking to reject requests with invalid or missing server names.
Configure sniStrict: true in TLS options so Traefik explicitly rejects connections from clients that do not supply a Server Name Indication header or attempt to connect to a domain that does not match any configured certificate.
tls: options: default: sniStrict: true
Enforce Strict Entrypoint and Network Boundary Restrictions
Approximately 646 tokens
Use when
Defining routers, ingress routes, and provider bindings that expose backend services across network interfaces.
Secure rules
Rule 1: Configure distinct private and public entrypoints when using providers such as Knative to prevent public exposure of internal services.
Define separate privateEntrypoints and publicEntrypoints in your provider configuration. Routes marked cluster-local should map exclusively to private entrypoints to ensure internal management APIs are not accidentally exposed to the public internet.
Rule 2: Explicitly restrict entrypoints on IngressRoute and HTTP routers instead of relying on defaults that bind to all interfaces.
Always explicitly define the entryPoints field for every HTTP router and IngressRoute resource. Omitting this field causes Traefik to attach the router to all configured entry points by default, potentially exposing internal routes on unencrypted or public networks.
Restrict Forwarded Headers and External Name Resolutions
Use when
Configuring entrypoints and providers in Traefik to handle incoming proxy headers and internal service routing boundaries.
Secure rules
Rule 1: Explicitly define trusted client proxy sources using forwardedHeaders.trustedIPs and keep forwardedHeaders.insecure disabled.
Never enable forwardedHeaders.insecure: true in production environments because it trusts incoming X-Forwarded-* headers blindly. Always specify trusted IP addresses or CIDR blocks using forwardedHeaders.trustedIPs to prevent IP spoofing and bypasses of rate-limiting or authentication controls.
Rule 2: Disable allowExternalNameServices in Kubernetes CRD and Ingress providers to prevent server-side request forgery.
Ensure allowExternalNameServices is set to false in the Traefik static configuration to stop Traefik from routing traffic to external CNAME DNS records. This prevents attackers from forcing proxy traffic to internal cloud metadata endpoints or internal infrastructure.
Configure Bounded Retries, Timeouts, and Health Checks
Approximately 669 tokens
Use when
Configuring load balancing retries, upstream timeouts, active/passive health checks, and circuit breakers for backend services.
Secure rules
Rule 1: Set explicit bounds on retry attempts, timeout durations, and maximum request body bytes.
Configure finite limits for attempts, timeout, and maxRequestBodyBytes to prevent memory exhaustion from request body buffering and request amplification storms. Avoid setting maxRequestBodyBytes to -1 and keep retryNonIdempotentMethod disabled unless upstream services explicitly support safe idempotent execution.
Rule 2: Define explicit backend forwarding timeouts and health check timeout thresholds
Specify explicit forwarding timeouts (dialTimeout, responseHeaderTimeout, idleConnTimeout) on servers transports and set healthCheck.timeout on load balancer services to prevent hanging connections and dead backends from consuming proxy resources.
Enforce Request Body Size and Rate Limits to Prevent Resource Exhaustion
Use when
When configuring Traefik middlewares or backend services to handle incoming HTTP requests and prevent resource starvation caused by unbounded request payloads or client request rates.
Secure rules
Rule 1: Configure explicit maximum request and response body size limits on buffering and forwarding middlewares
Set maxRequestBodyBytes and maxResponseBodyBytes on Buffering, and maxBodySize and maxResponseBodySize on ForwardAuth when it forwards bodies, to finite limits rather than leaving them unlimited.
Rule 2: Enforce non-zero rate limits on rate-limiting middleware configurations.
Ensure the average parameter is configured with a non-zero request rate when enabling the rateLimit middleware to prevent turning off rate limiting entirely.
Harden Container Runtime with Restricted Docker API Access and Privilege Restrictions
Approximately 717 tokens
Use when
Configuring container deployment for Traefik to run with least privilege and reduced attack surface.
Secure rules
Rule 1: Restrict Docker API access and enforce privilege restrictions
Do not rely on a read-only Docker socket mount to restrict Docker API operations. Connect Traefik to an authorization-filtering Docker API proxy, and configure no-new-privileges:true to limit privilege escalation.
Secure and Validate Traefik Plugins and Module Trust Boundaries
Use when
Configuring, installing, or executing third-party and custom Go or WebAssembly plugins within Traefik.
Secure rules
Rule 1: Restrict WASM plugin filesystem access with read-only mounts
Enforce strict least-privilege filesystem boundaries by appending the :ro suffix to host directory mounts in WASM plugin settings where write access is not required.
Rule 4: Restrict WebAssembly plugin module paths to local directories
Ensure manifest configuration references strictly local paths relative to the plugin directory and avoids absolute paths or directory traversal sequences.
{ "wasmPath": "bin/plugin.wasm"}
Rule 5: Limit environment variable exposure to WASM plugin instances
Restrict Settings.Envs to public or non-sensitive configuration keys required by the WASM module, avoiding process-level host secrets or API tokens.
Rule 6: Enforce hash verification when installing external plugins
Always define and enforce expected module hashes when installing external plugins to ensure packages are validated against configured descriptors before extraction.
Avoid Storing Sensitive Data in Container Labels and Service Tags
Approximately 569 tokens
Use when
Defining routing rules and service metadata for orchestrator providers like Docker, Swarm, ECS, Consul, and Nomad.
Secure rules
Rule 1: Do not embed credentials, tokens, or private keys inside container labels or service tags.
Container metadata and service discovery tags are exposed in plain text through API endpoints, inspection commands, and monitoring tools. Store sensitive configuration in dedicated secret stores, file-based providers, or secure storage systems instead of container labels or Consul/Nomad service tags.
Rule 1: Drop or redact sensitive authentication headers and query parameters from access logs, and remove authentication headers from backend requests
Configure header and query parameter filtering in Traefik access logs to explicitly drop or redact sensitive authorization details. When using BasicAuth or DigestAuth, explicitly set removeHeader to true to prevent forwarding the Authorization header to backend services.
accessLog: format: json fields: headers: defaultMode: drop names: Authorization: drop User-Agent: redact queryParameters: defaultMode: drop
Enforce Fail-Closed Behavior and Correct Ordering for Security Controls
Approximately 498 tokens
Use when
Configuring security middleware, rate limiting backends, or TLS default options where failure handling and execution order must prevent security control bypass or degradation.
Secure rules
Rule 1: Keep denyOnError enabled to ensure requests fail closed when storage backends are unavailable
For Traefik Hub’s Distributed RateLimit middleware, maintain denyOnError set to true so that incoming requests fail closed when the Redis storage backend becomes unreachable, preventing rate limiting bypass.
Rule 2: Apply security middlewares at the required trust boundary and preserve execution order
Attach security-critical middlewares to every applicable router or to the service when all routers using it must be protected; router-level middlewares run before service-level middlewares, and each list runs in declaration order.
Rule 3: Maintain a single cluster-wide default TLS option to prevent fallback degradation
Maintain at most one TLSOption resource named default across all namespaces to prevent duplicate resources from being dropped and Traefik’s internal default TLS options from being used.
Configure Secure and HttpOnly Attributes for Session and Sticky Cookies
Approximately 265 tokens
Use when
Configuring session or sticky session cookies across Traefik routing, middleware, and backend service configurations to protect tokens from interception and client-side script theft.
Secure rules
Rule 1: Explicitly set Secure and HttpOnly flags on session and sticky session cookies.
When configuring session identifiers or load balancer sticky session cookies, you must explicitly enable security flags such as secure: true and httpOnly: true along with strict sameSite attributes. Omitting these settings exposes session tokens to network eavesdropping over cleartext HTTP and client-side extraction through Cross-Site Scripting (XSS) vulnerabilities.
