Put a local inference endpoint behind an authenticated gateway

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R03 — OWASP API Authentication & Misconfiguration

   R26 — vLLM authentication & exposure guidance

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Place the local inference endpoint behind an authenticated API gateway that enforces tenant routing and request identity propagation.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Test unauthenticated requests, forged tenant headers, and direct probing of /health, /metrics, and /admin routes for unintended sensitive disclosure.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Gateway authentication and tenant-routing integration tests.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R03OWASP API Security Top 10↗ owasp.org

  BOLA (API1), Broken Auth (API2), Unrestricted Resource Consumption (API4), SSRF (API7), Misconfiguration (API8).

• R26vLLM Documentation↗ docs.vllm.ai

  Serving architecture, OpenAI-compatible server, authentication, concurrency flags, and production deployment.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsLiteLLM · ~10 min read
  Life of a Request

  Traces one request through virtual-key auth, per-key/user/team rate limits and router selection before it reaches the model, the exact hop sequence your authenticated gateway inserts.

  R26checked 2026-11-11
• videoMd Junaid Alam · ~20 min
  LiteLLM Tutorial Part 3 | Proxy Gateway, Local Models, Guardrails & Virtual Keys

  Sets up the proxy as a gateway in front of a local model and issues virtual keys, so the model endpoint is never called with the caller's own credential.

  R26checked 2026-11-11
• videoAlejandro AO · ~20 min
  Tutorial: Auth for Remote MCP Servers (Step by Step) | OAuth 2.1 with ScaleKit

  Builds an authenticating front door in FastAPI that validates tokens and maps scopes per route before forwarding, the same pattern for propagating request identity inward.

  R03checked 2026-11-11
• articleFusionAuth · ~15 min read
  JWT authorization in a microservices gateway

  Shows the gateway validating the caller then minting and forwarding a token with tenant and role claims, which is how identity and tenant routing reach the model server.

  R03checked 2026-11-11
• labLiteLLM · ~30 min hands-on
  Getting Started Tutorial - LiteLLM Docs

  Runs gateway plus Postgres via compose, creates a scoped virtual key and serves a request through the gateway, the fastest way to stand up the authenticated proxy in front of your local vLLM.

  R26checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.