Putting modern auth in front of an app that has none

Legacy web apps that cannot do modern auth are exactly what gets swept up in credential stuffing and the year's run of authentication-bypass CVEs. You often cannot change the app, so you change what sits in front of it. This is the infrastructure twin of the App Mod dive on adding MFA to an app with no MFA support.

1. The problem app. A line-of-business web app with no SSO, no MFA, and no vendor roadmap.
2. The proxy pattern. Terminating at a reverse proxy, authenticating there, injecting trusted headers to the app.
3. Not breaking the app. Session handling, timeouts and the gotchas that make apps misbehave behind a proxy.
4. Hardening the edge. WAF rules and egress control so the proxy is not the new weak point.
5. When to proxy vs modernise. The decision that feeds an App Mod scope.

A pure engineering-craft piece: no CVE headline, just the pattern we deploy over and over. It shows a technical reader we solve the boring, real problem (the app you cannot change) rather than selling a rebuild they cannot afford. Cross-links to App Mod so the two lenses reinforce each other.

• Lead with the engineering, not a threat; this is a how-we-build piece.
• Be specific about session and header pitfalls; that detail is the credibility.
• Make the proxy-vs-rebuild call explicit, and point to the App Mod discovery.
• Keep security as the closing ratification, not the opening frame.