I am not sure how this comment applies? The choice for oauth2_proxy in my case was, because it is a solution that already existed. You certainly could put a stateful session service as the auth-request backend, my Lua script is agnostic to that. As an example: For one project I put a service that validated IP addresses against Tor's RBL behind nginx' auth_request module.