---
title: Protecting an application with PingGateway
description: This section gives a simple example of how to use PingGateway to protect an application. For many more examples of how to protect applications with PingGateway, refer to the Gateway guide.
component: pinggateway
version: 2026
page_id: pinggateway:getting-started:using
canonical_url: https://docs.pingidentity.com/pinggateway/2026/getting-started/using.html
revdate: 2025-04-01T17:53:34Z
keywords: ["Install", "Configuration", "Security", "Authentication"]
---

# Protecting an application with PingGateway

This section gives a simple example of how to use PingGateway to protect an application. For many more examples of how to protect applications with PingGateway, refer to the [Gateway guide](../gateway-guide/preface.html#preface).

In the following example, a browser requests access to the sample application, and PingGateway intercepts the request to log the user into the application. The following image shows the flow of data in the example:

![hard-coded-login](https://kroki.io/plantuml/svg/eNqFkctOwzAURPf3K0YsYNWmIIRQF0iAELCiohF717lNLDm2sZ2GfhK_wZdxE0U8JB4rPzRzZnxNxRHh2od9NHWT8faKk8XxKWaynJxhZVyN-4pdNnkvshh8VNl4R4SyMQnaVwxZs8eG0SWuwC_adsns2O5hnCicYz140Jvc_IFE8tvcq8jwEYnjzmhOc_rdAe8kw2-3HBNSp5sfCUM3y7WyGAmGE6FvPBq14-GKo5Q2TlQKG-OqIc2K0SWGqiNzK6J_us_pqCAi1WXvunbDkYKK2WgTlHgPrqLvpc4BVMK0_y4YwLcqc6_2o2jafxetVRss4zIEqTfGjlo5E03U2cXkXGLNrsJdWa5we1Mi8nPHKQ-zaHIOy6Iw9ZxfRuJc-3Z5vjhfFCkLVhNNkNmFsJd45GCV5g_GOIqRvHpYlzJ_WF_LT299bInE8qXFk7KmksMkOZRfkVqRU_Ay3y9J0wOGtNxF9yl5BwX27GY=?id=figure-hard-coded-login)

1. The browser sends an HTTP GET request to the HTTP server on `ig.example.com`.

2. PingGateway replaces the HTTP GET request with an HTTP POST login request containing credentials to authenticate.

3. The sample application validates the credentials, and returns the page for the user `demo`.

   If PingGateway did not provide the credentials, or if the sample application couldn't validate the credentials, the sample application returns the login page.

4. PingGateway returns this response to the browser.

Configure PingGateway to log you in to an application

1. Set up PingGateway and the sample application as described in this guide.

2. Add the following route to PingGateway to serve the sample application .css and other static resources:

   * Linux

     `$HOME/.openig/config/routes/00-static-resources.json`

   * Windows

     `%appdata%\OpenIG\config\routes\00-static-resources.json`

   ```json
   {
     "name" : "00-static-resources",
     "baseURI" : "https://app.example.com:8444",
     "condition": "${find(request.uri.path,'^/css') or matchesWithRegex(request.uri.path, '^/.*\\\\.ico$') or matchesWithRegex(request.uri.path, '^/.*\\\\.gif$')}",
     "handler": "ReverseProxyHandler"
   }
   ```

   Source: [00-static-resources.json](../_attachments/config/routes/00-static-resources.json)

3. Add the following route to PingGateway:

   * Linux

     `$HOME/.openig/config/routes/01-static.json`

   * Windows

     `%appdata%\OpenIG\config\routes\01-static.json`

   ```json
   {
     "handler": {
       "type": "Chain",
       "config": {
         "filters": [
           {
             "type": "StaticRequestFilter",
             "config": {
               "method": "POST",
               "uri": "https://app.example.com:8444/login",
               "form": {
                 "username": [
                   "demo"
                 ],
                 "password": [
                   "Ch4ng31t"
                 ]
               }
             }
           }
         ],
         "handler": "ReverseProxyHandler"
       }
     },
     "condition": "${find(request.uri.path, '^/static')}"
   }
   ```

   Source: [01-static.json](../_attachments/config/routes/01-static.json)

   Notice the following features of the route:

   * The route matches requests to `/static`.

   * The StaticRequestFilter replaces the request with an HTTP POST, specifying the resource to post the request to, and a form to include in the request. The form includes credentials for the username `demo`.

   * The ReverseProxyHandler replays the request to the sample application.

4. Check that the route system log includes a message that the new files are loaded into the config:

   ```none
   INFO  o.f.o.handler.router.RouterHandler - Loaded the route with id '00-static-resources' registered with the name '00-static-resources'
   INFO  o.f.o.handler.router.RouterHandler - Loaded the route with id '01-static' registered with the name '01-static'
   ```

5. Go to <http://ig.example.com:8080/static>.

   You are directed to the sample application, and logged in automatically with the username `demo`.