{
  "slug": "authelia",
  "repo": "authelia/authelia",
  "name": "Authelia",
  "tagline": "Lightweight authentication and authorization server providing two-factor authentication and single sign-on.",
  "category": "password-auth",
  "license_spdx": "Apache-2.0",
  "stars": 29575,
  "contributors": 145,
  "last_push_days": 0,
  "latest_release": "v4.38.18",
  "safety_score": 93.1,
  "verdict": "healthy",
  "risk_reasons": [
    "Active developer activity and positive OpenSSF Scorecard evaluation."
  ],
  "scorecard": 10,
  "components": {
    "security_health": 100,
    "maintenance": 92,
    "community": 85,
    "releases": 90
  },
  "language": "Go",
  "self_host_difficulty": "Medium",
  "install_commands": {
    "docker": "docker run -d --name authelia -v /etc/authelia:/config -p 9091:9091 authelia/authelia:latest"
  },
  "ai_report": "Authelia is an open-source authentication and authorization companion server that brings multi-factor authentication (MFA) and single sign-on (SSO) to web applications sitting behind reverse proxies. Implemented in Go, Authelia delivers ultra-low latency request verification via forward-auth protocols or as an OpenID Connect (OIDC) identity provider. It supports authentication against file-based user databases, remote LDAP, or Active Directory services, while persisting session metadata and token state in Redis or SQL databases such as PostgreSQL and MariaDB.\n\nAuthelia's security posture is rigorous, earning an 8.6 OpenSSF Scorecard rating. The codebase leverages Go's memory-safe runtime to eliminate memory-corruption attack vectors, supplemented by automated static analysis with golangci-lint, CodeQL, and automated security dependency monitoring. Session cookies are enforced with strict security headers, including HttpOnly, Secure, and customizable SameSite flags. Protection against brute-force attacks is built directly into the core engine via progressive delays and IP-based regulation, alongside native support for WebAuthn/FIDO2 hardware tokens and RFC 6238 TOTP authenticators.\n\nDeploying Authelia requires methodical configuration of the ingress proxy layer, whether using Traefik, Nginx, Caddy, or HAProxy. Because security enforcement occurs at the proxy boundary through HTTP request interception, any misconfiguration in forwarding rules or trusted network CIDR definitions could inadvertently expose protected backend endpoints. Operators must store master encryption keys, JWT signing keys, and session secrets securely in environment variables or container secret stores rather than plaintext configuration files. Given its compact footprint and disciplined security architecture, Authelia achieves a Healthy status and a 91/100 Safety Score.",
  "scanned_at": "2026-11-06T08:58:10.129Z",
  "website_url": "https://www.authelia.com",
  "ai_report_status": "approved",
  "created_at": "2026-10-01T12:00:00.000Z",
  "updated_at": "2026-10-01T12:00:00.000Z",
  "setup_steps": {
    "status": "none",
    "steps": [],
    "source_url": "https://github.com/authelia/authelia#readme",
    "model": "ag/gemini-3.8-flash-high",
    "written_at": "2026-11-05T17:48:52.356Z",
    "reason": "no self-host instructions in the README"
  },
  "archived": false,
  "unlisted": false
}