OpenResty is wonderful.<p>My employer sells an authorization and access control engine that can be queried by simple REST calls.  We produced a small lua module that makes it simple to use from an `_by_lua_` directive.<p>Our customers (and internal teams) love it -- for the most part they use it to provide basic access control to simple web services, but some have done really sophisticated things things, such as deciding what privileges an HTTP request requires based on the body, query parameters, method, and headers.<p>HTTP clients can simply provide an authentication token issued by our services in a header, and everything works like magic.<p>At some point we were considering writing our own nginx module, and while we have the engineering talent to pull this off, OpenResty is just so much simpler, so it won the day hands down.