access_by_lua is a very nice feature.

I had an idea for microservice deployments: to send all incoming requests through an authenticator script, that will verify request tokens with the auth-server, and extract the user's context to some other request parameter (e.g. custom header). The benefit would be that all microservices no longer need to worry about the authorisation of incoming requests, as this is abstracted away to nginx. In this way we know that if a request reaches the target service, it has already been authorised, thus simplifying the services and removing the dependency on the auth-server, and decreasing the burden of testing these services. It works nicely.

The (very rough) script is here: https://gist.github.com/rahilb/73362f663a028f1f986c