Does Selenium Grid Hub support native authentication for remote endpoints?

Securing the RemoteWebDriver Hub

Selenium Grid 4.x allows for the distribution of tests across multiple nodes via a central hub. By default, the hub listens on port 4444 to receive JSON requests from clients. However, the hub does not natively implement an authentication layer or TLS encryption for these incoming connections.

In environments where the hub must be accessible across a network, there is a risk of accidental public exposure. Because the hub accepts any valid JSON request without credential verification, security is typically deferred to external infrastructure such as VPNs, firewalls, or reverse proxies.

Given the current architecture of the Selenium server, what are the implications for teams requiring granular access control at the application level? Does Selenium provide any internal mechanism to restrict job submissions to specific authenticated clients, or is external proxying the only viable solution for securing the endpoint?