KB / Memory / tech-forwardauth-preserve-status

forwardAuth must preserve status

Error pages middleware can rewrite 302 challenges into 401/500 and break OAuth

tech
techinfrasecurity
raw .md

When Traefik forwardAuth + OAuth2 Proxy sit behind error middleware, ensure 302 challenges are not replaced by generic error pages.

Pattern: explicit redirect path for auth challenges. Generic edge auth lesson — no private hostnames.