KB / Memory / tech-forwardauth-preserve-status
forwardAuth must preserve status
Error pages middleware can rewrite 302 challenges into 401/500 and break OAuth
When Traefik forwardAuth + OAuth2 Proxy sit behind error middleware, ensure 302 challenges are not replaced by generic error pages.
Pattern: explicit redirect path for auth challenges. Generic edge auth lesson — no private hostnames.