Proposal: Reduce proxy surface
In production, every public server is continuously scanned and attacked. Most of these operations are performed by bots to analyze common vulnerabilities on common systems (WordPress, JBoss, etc.). These operations do not pose a risk to iam-proxy-italia, but they consume resources and are really tedious. In production, logs last for 1 year, and it's almost all spam, scanning of common paths that generate resource errors.
At this moment NGINX try to search the request in his root, if there is no match send everything to satosa. We could reduce these noise requests by limiting the proxy to only the paths required. Each path required from a plugin start with the plugin name (es: Saml2, Saml2IDP, OIDC, CieSaml2, ecc.), we colud proxy only theese base paths.
what do you think?