REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL is not generating the correct config

Community Support
1

Hello,

BW version: 1.6.12-rc2

I am using bunkerweb with Authentik forward-auth. Below are the configuration that I apply to the containers where I want forward-auth (in addition to basic reverse proxy settings that are not shown here).

This works:

  bunkerweb.REVERSE_PROXY_AUTH_REQUEST: /outpost.goauthentik.io/auth/nginx
  bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SET: $$auth_cookie $$upstream_http_set_cookie;$$authentik_username $$upstream_http_x_authentik_username;$$authentik_groups $$upstream_http_x_authentik_groups;$$authentik_entitlements $$upstream_http_x_authentik_entitlements;$$authentik_email $$upstream_http_x_authentik_email;$$authentik_name $$upstream_http_x_authentik_name;$$authentik_uid $$upstream_http_x_authentik_uid
  bunkerweb.REVERSE_PROXY_HEADERS: X-authentik-username $$authentik_username;X-authentik-groups $$authentik_groups;X-authentik-entitlements $$authentik_entitlements;X-authentik-email $$authentik_email;X-authentik-name $$authentik_name;X-authentik-uid $$authentik_uid
  bunkerweb.REVERSE_PROXY_HEADERS_CLIENT: Set-Cookie $$auth_cookie
  bunkerweb.REVERSE_PROXY_URL_999: /outpost.goauthentik.io
  bunkerweb.REVERSE_PROXY_HOST_999: http://authentik-server:9000
  bunkerweb.REVERSE_PROXY_HEADERS_999: "X-Original-URL $$scheme://$$http_host$$request_uri;Content-Length \"\""
  bunkerweb.REVERSE_PROXY_HEADERS_CLIENT_999: Set-Cookie $$auth_cookie
  bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SET_999: $$auth_cookie $$upstream_http_set_cookie
  bunkerweb.REVERSE_PROXY_PASS_REQUEST_BODY_999: no
  bunkerweb.REVERSE_PROXY_INTERCEPT_ERRORS: no
  bunkerweb.ERRORS: 401=@goauthentik_proxy_signin
  bunkerweb.CUSTOM_CONF_SERVER_HTTP_goauthentik_signin: |
    location @goauthentik_proxy_signin {
        internal;
        add_header Set-Cookie $$auth_cookie;
        return 302 /outpost.goauthentik.io/start?rd=$$scheme://$$http_host$$request_uri;
    }

This fails, it shows a nginx error 401:

  bunkerweb.INTERCEPTED_ERROR_CODES: 400 403 404 405 413 429 500 501 502 503 504
  bunkerweb.REVERSE_PROXY_AUTH_REQUEST: /outpost.goauthentik.io/auth/nginx
  bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL: "$$scheme://$$host/outpost.goauthentik.io/start?rd=$$scheme%3A%2F%2F$$host$$request_uri"
  bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SET: $$auth_cookie $$upstream_http_set_cookie;$$authentik_username $$upstream_http_x_authentik_username;$$authentik_groups $$upstream_http_x_authentik_groups;$$authentik_entitlements $$upstream_http_x_authentik_entitlements;$$authentik_email $$upstream_http_x_authentik_email;$$authentik_name $$upstream_http_x_authentik_name;$$authentik_uid $$upstream_http_x_authentik_uid
  bunkerweb.REVERSE_PROXY_HEADERS_CLIENT: Set-Cookie $$auth_cookie
  bunkerweb.REVERSE_PROXY_HEADERS: X-authentik-username $$authentik_username;X-authentik-groups $$authentik_groups;X-authentik-entitlements $$authentik_entitlements;X-authentik-email $$authentik_email;X-authentik-name $$authentik_name;X-authentik-uid $$authentik_uid
  bunkerweb.REVERSE_PROXY_URL_999: /outpost.goauthentik.io
  bunkerweb.REVERSE_PROXY_HOST_999: http://authentik-server:9000
  bunkerweb.REVERSE_PROXY_HEADERS_999: "X-Original-URL $$scheme://$$http_host$$request_uri;Content-Length \"\""
  bunkerweb.REVERSE_PROXY_HEADERS_CLIENT_999: Set-Cookie $$auth_cookie
  bunkerweb.REVERSE_PROXY_AUTH_REQUEST_SET_999: $$auth_cookie $$upstream_http_set_cookie
  bunkerweb.REVERSE_PROXY_PASS_REQUEST_BODY_999: no

For the above config, I took inspiration from bunkerweb/examples/authentik/autoconf.yml at master · bunkerity/bunkerweb · GitHub
It appears that REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL is not generating error_page 401directive (I could not find it in the resulting nginx config).

To fix it, I had to do a custom config as shown in the working example.

Additionnally, I recommend avoiding to write app1.example.com in your example. Making it non app-specific allows to do anchor and alias to all apps that would require forward-auth, making much cleaner compose files.

2

**Confirmed bug, and thanks for the really clear write-up.**

The culprit is the validation pattern on `REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL`. It only accepted a literal `http://` or `https://` scheme followed by a literal hostname. So a value built from NGINX variables, like `$scheme://$host/outpost.goauthentik.io/start?rd=…`, didn’t match and got silently dropped.

You can actually spot it in the scheduler logs:

```

Ignoring variable REVERSE_PROXY_AUTH_REQUEST_SIGNIN_URL : value $scheme://$host/… doesn’t match regex …

```

Once the value is dropped, the `error_page 401 =302 …;` directive never gets written into the config, which is why NGINX just hands back a raw 401 instead of redirecting. That also explains why your hardcoded `CUSTOM_CONF_*` workaround behaved fine: a literal URL passed validation.

We’re shipping a fix that lets the setting accept NGINX variables (`$scheme`, `$host`, `$request_uri`, and friends) while still rejecting anything that could smuggle in extra directives. We also reworked the official `examples/authentik` so it uses one domain-agnostic value instead of a per-app hostname:

```

$scheme://$host/outpost.goauthentik.io/start?rd=$scheme%3A%2F%2F$host$request_uri

```

That way the same line works for every protected service, which is exactly the doc improvement you suggested.

One thing worth keeping in mind for any forward-auth setup: make sure `401` is **not** in `INTERCEPTED_ERROR_CODES`. If it is, BunkerWeb’s error pages catch the 401 before the sign-in redirect can fire. Your config already handles this correctly, but it trips a lot of people up.