# Anonymous Access

> Octelium documentation. Canonical page: <https://octelium.com/docs/octelium/latest/management/core/service/anonymous-access>.

In addition to securely exposing *Services* publicly via the BeyondCorp access mode (read more [here](https://octelium.com/docs/octelium/latest/management/core/service/clientless.md)), Octelium also enables you to completely publicly expose HTTP-based *Services* (namely `HTTP`, `GRPC` and `WEB` *Service* modes) to anonymous access, eliminating access control for such *Services*. This allows you to effectively use Octelium as a hosting platform where you can publicly expose *Services* to the public internet whose upstreams might be served from anywhere (e.g anywhere behind NAT such as your laptop, private clouds, etc...), as well as a self-hosted PaaS for containerized applications that are deployed and managed by Octelium itself (read more about managed containers [here](https://octelium.com/docs/octelium/latest/management/core/service/managed-containers.md)).

> **Note:**
>
> It's **extremely** important to understand that enabling the anonymous public mode for a certain *Service* completely eliminates both authentication and authorization for that *Service*. This is by itself against what zero trust is all about. If you want anonymous authorization, checkout out that section [here](#anonymous-authorization).

> **Note:**
>
> The Octelium *Cluster* currently uses the anonymous mode mainly for the *AuthService* which is exposed publicly to the internet to authenticate the users, both via `WEB` mode using OpenID Connect and SAML 2.0 identity providers (IdPs) as well as for its authentication gRPC service.

To enable the anonymous public mode, you only need to enable the `isPublic` and `isAnonymous` fields as follows:

```yaml
kind: Service
metadata:
  name: svc1
spec:
  mode: HTTP
  config:
    upstream:
      url: http://nginx.local
  isPublic: true
  #!mark
  isAnonymous: true
```

## Anonymous Authorization

Starting from `v0.28.0`, Octelium can now provide anonymous authorization via the `enableAnonymous` boolean flag. This effectively enables anonymous *Services* to operate as web application firewalls (WAF) and control access based on the request's path, method, headers (e.g. user agent), query parameters, and body content, including serialized JSON body content. Here is an example:

```yaml
kind: Service
metadata:
  name: svc1
spec:
  mode: HTTP
  isPublic: true
  isAnonymous: true
  config:
    upstream:
      url: https://example.com
  authorization:
    # !mark
    enableAnonymous: true
    inlinePolicies:
      - spec:
          rules:
          - effect: ALLOW
            condition:
              all:
                of:
                - match: ctx.request.http.method in ["GET", "POST", "PUT", "DELETE"]
                - match: ctx.request.http.path.startsWith("/apis")
                - match: ctx.request.http.uri == "/apis/users?name=john"
                - match: ctx.request.http.queryParams.name == "john"
                - match: ctx.request.http.headers["x-custom-header"] == "this-value"
                - match: ctx.request.http.scheme == "http"
                - match: string(ctx.request.http.body).toLower().contains("value1")
                - match: ctx.request.http.bodyMap.key1 == "value1"
```

As is the case with the default authenticated authorization, anonymous authorization, when enabled, denies all requests by default (i.e. a status code of `403` is returned). That means the request is denied if no rule matches.

> **Note:**
>
> You might also want to check out [HTTP plugins](https://octelium.com/docs/octelium/latest/management/core/service/http-plugins.md) to implement the same filtering functionality in the anonymous mode while being able to return custom response status codes, body content and headers.

## Public DNS and TLS Certificate

Since public *Services* are exposed to the internet, you need to set the public DNS and TLS certificate of the *Service*. You can read more about managing public DNS [here](https://octelium.com/docs/octelium/latest/install/cluster/dns.md) and TLS certificates [here](https://octelium.com/docs/octelium/latest/install/cluster/tls-certificate.md).