Force label through HTTP Header

Is your feature request related to a problem? Please describe.

Currently Loki without some custom proxy accepts every log line regardless of its contents which could allow one host or application to impersonate another one in the same loki tenant. This is especially useful when hosts aren't fully trusted, for example in edge computing or when collecting logs from client devices.

Describe the solution you'd like

An optional HTTP header that allows the reverse proxy that is doing the authentication in front of loki to force a label on every log entry. This way one can rely on a label that i.e. represents the username that was used for authentication for filtering hosts and applications apart.

Describe alternatives you've considered

• Using a custom proxy in front of loki that rewrites the requests, which implies a performance overhead.
• Using rsyslog which logs IP-Addresses at the expense of almost all loki features.