NGINX auth_request: Lacking native credential expiration handling

Goal

We need to enforce least‑privilege authentication while ensuring credentials expire automatically.

Current Constraints

NGINX’s auth_basic validates against static credentials and auth_request delegates to an external service, but neither interprets token expiry or revocation.

Uncertainty

There is no documented NGINX directive that enforces expiration. The core team has not defined whether a native expiration feature should be added or whether external services must handle it.

Questions

• Does the auth_request module support any built‑in mechanism for checking credential expiry?
• What are the recommended patterns for integrating expiration logic when using external authentication endpoints?
• Is there a planned or proposed directive in the NGINX roadmap to support native credential expiration?