Skip to content

[BUG] Redirect issue #1021

Closed
Closed
[BUG] Redirect issue#1021
Assignees
steveiliop56
Labels
bugSomething isn't working

Description

@mmolitor87
mmolitor87
opened on Jul 17, 2026

Describe the Bug

I have tinyauth configured on tinyauth.domain.com. I use it to protect domain.com, which correctly redirects to tinyauth, but then successful authentication leads to tinyauth.domain.com instead of the root domain. This does not happen with any subdomains.

Happens since 5.1.0 and still on 5.1.1, but not on 5.0.7.

I believe it may be redirected to #937

How to Reproduce

  1. Put tinyauth in front of root domain
  2. Go to domain.com
  3. Sign into tinyauth
  4. Get redirected to tinyauth.domain.com/logout

Expected Behavior

Get redirected back to root domain.

Additional Context

No response

Logs

No response

Operating System

Windows and MacOS

Browser

Chrome, Firefox and Safari

Tinyauth Version

5.1.0 / 5.1.1

Docker Version (if applicable)

No response

Human Written Confirmation

  • I confirm this issue was written by me and not generated by an LLM or AI assistant.

Activity

  1. mmolitor87
    assigned
    steveiliop56
    on Jul 17, 2026
  2. mmolitor87
    added
    bugSomething isn't working
    on Jul 17, 2026

  3. dosubot commented on Jul 17, 2026

    @dosubot
    dosubotbot
    on Jul 17, 2026 – with DosuBot

    Hi @mmolitor87! I'm Dosu and I'm helping the Tinyauth team.

    This looks like a regression introduced by PR #950, which refactored how redirect validation works. The root cause is in the isRedirectSafe() function [1], which validates redirects in two phases:

    1. Phase 1 — checks if the redirect URI exactly matches the AppURL. For your case, domain.com ≠ tinyauth.domain.com, so this fails.
    2. Phase 2 — if subdomains are enabled, checks if the redirect hostname ends with ".{CookieDomain}" (note the dot prefix). Since GetCookieDomain() strips the leftmost label from tinyauth.domain.com to produce domain.com [2], the check becomes: does "domain.com" end with ".domain.com"? It doesn't — because domain.com is the cookie domain, not a subdomain of it.

    So the root domain gets rejected by both phases, and the frontend falls back to redirecting to /logout [3].

    Before v5.1.0, redirect validation used a pre-built TrustedDomains list that likely included both the AppURL host and the cookie domain, which is why v5.0.7 worked correctly.

    Regarding issue #937 — that's actually about trailing slashes in TINYAUTH_APPURL causing double-slash URLs [4], so it's a separate issue from what you're experiencing.

    To reply, just mention @dosu.

    Docs are dead. Just use Dosu.

    Leave Feedback Ask Dosu about tinyauth Share Dosu with your team

  4. steveiliop56 commented on Jul 17, 2026

    @steveiliop56
    steveiliop56
    on Jul 17, 2026
    Member

    Hello @mmolitor87 this is a bit of weird edge-case that I haven't considered. In v5.1.0, we made the validation engine much more strict for input URLs to avoid any sort of bypass. Tinyauth is meant to protect stuff on the same part of the domain as itself (so under .example.com) but I guess we could also add an exception for the parent domain. Authentication is working fine though right?

    If authentication is working, would it be too much of an inconvenience to wait maybe a week for a patch? I don't want to create a new release for every bug (except the ones impacting functionality like in v5.1.1) so I would like to wait a bit in case there are other issues.

  5. Nomar383 commented on Jul 17, 2026

    @Nomar383
    Nomar383
    on Jul 17, 2026

    For what it's worth, my small setup is exactly the same (redirect to the root domain) and I'm running into the same bug. Thanks for looking into it though!

  6. mmolitor87 commented on Jul 18, 2026

    @mmolitor87
    mmolitor87
    on Jul 18, 2026
    Author

    @steveiliop56 Authentication works fine. I can wait for it to be bundled with something else. It is simply annoying, since I have homepage on the root domain protected by tinyauth.

  7. Fla95100 commented on Jul 18, 2026

    @Fla95100
    Fla95100
    on Jul 18, 2026

    I'm hitting what looks like the same underlying bug, but with a slightly different trigger: subdomain protecting another subdomain, with TOTP enabled, not root domain.

    Setup

    • Tinyauth: auth.example.com (also a subdomain, not root domain)
    • Protected app: app.example.com (a self-hosted app using header-based remote-user auth, via remote_user_guard)
    • Reverse proxy: Nginx Proxy Manager (auth_request + /api/auth/nginx), behind Cloudflare
    • COOKIE_DOMAIN=example.com, APP_URL=https://auth.example.com
    • Tinyauth version: v5.1.1
    • Local auth provider with TOTP enabled

    Reproduction

    1. Visit app.example.com while unauthenticated
    2. Correctly redirected to https://auth.example.com/login?redirect_uri=https://app.example.com/
    3. Submit username/password → 200 "TOTP required", correct session cookie set
    4. Redirected to /totp?redirect_uri=https%3A%2F%2Fapp.example.com%2F (redirect_uri correctly preserved)
    5. Submit TOTP code (once, no double submit) → POST /api/user/totp returns 200 "Login successful" with a valid new session cookie
    6. Immediately after, the frontend navigates to GET /logout instead of following the redirect_uri / showing the continue screen

    Confirmed via HAR that redirect_uri is present and correct at every single step up to and including the TOTP page, and the session cookie set on the successful TOTP response looks valid (correct Domain, SameSite=Lax, HttpOnly, proper expiry). The jump to /logout happens client-side (referer on the /logout request is the /totp?redirect_uri=... page), so it looks like a frontend routing issue after the TOTP step specifically, separate from (or compounding) the root-domain case described above.

    Note: the protected app itself isn't relevant to the bug — the issue is entirely within the tinyauth login/TOTP → redirect flow, before any request reaches the protected app.

    Happy to share the full HAR trace (redacted) if useful.

  8. erwinkramer commented on Jul 18, 2026

    @erwinkramer
    erwinkramer
    on Jul 18, 2026

    @Fla95100 similar issue here as u have. I'm going from https to http subdomain though, but yes this worked before

  9. steveiliop56 commented on Jul 18, 2026

    @steveiliop56
    steveiliop56
    on Jul 18, 2026
    Member

    @Nomar383 @erwinkramer relevant issue #1023

  10. steveiliop56
    closed this as completedin 0fc87adon Jul 18, 2026

  11. erwinkramer commented on Jul 18, 2026

    @erwinkramer
    erwinkramer
    on Jul 18, 2026

    @steveiliop56 for me it's not in context of nginx, are you sure that solves it for others? Like caddy.

  12. steveiliop56 commented on Jul 18, 2026

    @steveiliop56
    steveiliop56
    on Jul 18, 2026
    Member

    @erwinkramer you replied to Fla95100 whose issue is basically the login_for parameter missing. If you use another proxy then you don't have the same issue with. Where you trying to access domain.com with Tinyauth on example.domain.com?

  13. erwinkramer commented on Jul 18, 2026

    @erwinkramer
    erwinkramer
    on Jul 18, 2026

    @steveiliop56 yeah sorry for the confusion, only the first part is similar, so I have:

    auth.example.com (also a subdomain, not root domain)
    Protected app: app.example.com

    In a regular OAuth setup with caddy, tinyauth an GitHub login.

  14. steveiliop56 commented on Jul 18, 2026

    @steveiliop56
    steveiliop56
    on Jul 18, 2026
    Member

    Hmm, can you please share your logs with TINYAUTH_LOG_LEVEL=debug while trying to login.

  15. erwinkramer commented on Jul 18, 2026

    @erwinkramer
    erwinkramer
    on Jul 18, 2026

    @steveiliop56 see below, I think there is some hint where it mentions "No matching container found for domain" or " Failed to validate redirect URI [..] "scheme mismatch"" (I'm doing https to http redirect).

    auth
date,stream,content
2026/07/18 16:13:04,stderr,�[90m2026-07-18T16:13:04+02:00�[0m DBG �[1minternal/middleware/zerolog_middleware.go:77�[0m�[36m >�[0m Request �[36maddress=�[0m127.0.0.1:37166 �[36mclient_ip=�[0m127.0.0.1 �[36mlatency=�[0m"42.317µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/healthz �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:12:29,stderr,�[90m2026-07-18T16:12:29+02:00�[0m DBG �[1minternal/middleware/zerolog_middleware.go:77�[0m�[36m >�[0m Request �[36maddress=�[0m127.0.0.1:37158 �[36mclient_ip=�[0m127.0.0.1 �[36mlatency=�[0m"49.44µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/healthz �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37712 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m30.484637ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m0 �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mdozzle.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:12:07,stderr,�[90m2026-07-18T16:12:07+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37708 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m28.402512ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m0 �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mdozzle.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37704 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m51.76513ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m0 �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mdozzle.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37702 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m29.918039ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m0 �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mdozzle.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37700 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m30.053494ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m0 �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mdozzle.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37700 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m30.74014ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m302 �[36mstream=�[0mhttp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mdozzle.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37630 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m27.162503ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m0 �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mdozzle.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:12:04,stderr,�[90m2026-07-18T16:12:04+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:12:02,stderr,�[90m2026-07-18T16:12:02+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m"20.231µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/context/user �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:12:02,stderr,�[90m2026-07-18T16:12:02+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:12:02,stderr,�[90m2026-07-18T16:12:02+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37694 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m"67.502µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/context/app �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:59,stderr,�[90m2026-07-18T16:11:59+02:00�[0m DBG �[1minternal/middleware/zerolog_middleware.go:77�[0m�[36m >�[0m Request �[36maddress=�[0m127.0.0.1:37116 �[36mclient_ip=�[0m127.0.0.1 �[36mlatency=�[0m"71.902µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/healthz �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:59,stderr,�[90m2026-07-18T16:11:59+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m"29.587µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/context/user �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:59,stderr,�[90m2026-07-18T16:11:59+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:11:59,stderr,�[90m2026-07-18T16:11:59+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m"48.777µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/context/app �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:59,stderr,�[90m2026-07-18T16:11:59+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m1.693662779s �[36mmethod=�[0mGET �[36mpath=�[0m/api/oauth/callback/github �[36mstatus=�[0m307 �[36mstream=�[0mhttp

2026/07/18 16:11:59,stderr,�[90m2026-07-18T16:11:59+02:00�[0m DBG �[1minternal/controller/oauth_controller.go:258�[0m�[36m >�[0m Creating session cookie for user �[36mstream=�[0mapp

2026/07/18 16:11:59,stderr,�[90m2026-07-18T16:11:59+02:00�[0m DBG �[1minternal/controller/oauth_controller.go:241�[0m�[36m >�[0m Using preferred username from OAuth provider �[36mstream=�[0mapp

2026/07/18 16:11:59,stderr,�[90m2026-07-18T16:11:59+02:00�[0m DBG �[1minternal/controller/oauth_controller.go:226�[0m�[36m >�[0m Using name from OAuth provider �[36mstream=�[0mapp

2026/07/18 16:11:58,stderr,�[90m2026-07-18T16:11:56+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m"980.317µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/oauth/url/github �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:58,stderr,"�[90m2026-07-18T16:11:56+02:00�[0m �[33mWRN�[0m �[1minternal/controller/oauth_controller.go:86�[0m�[36m >�[0m �[1mUnsafe redirect URI, ignoring�[0m �[36mredirectUri=�[0mhttp://dozzle.nasi.guanchen.nl/ �[36mstream=�[0mapp
"
2026/07/18 16:11:56,stderr,�[90m2026-07-18T16:11:56+02:00�[0m DBG �[1minternal/controller/oauth_controller.go:333�[0m�[36m >�[0m Failed to validate redirect URI �[36merror=�[0m�[31m�[1m"scheme mismatch"�[0m�[0m �[36mstream=�[0mapp

2026/07/18 16:11:51,stderr,�[90m2026-07-18T16:11:51+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m"44.666µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/context/user �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:51,stderr,�[90m2026-07-18T16:11:51+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m"49.355µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/context/app �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:51,stderr,�[90m2026-07-18T16:11:51+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37630 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m66.438811ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m302 �[36mstream=�[0mhttp

2026/07/18 16:11:51,stderr,�[90m2026-07-18T16:11:51+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:11:51,stderr,�[90m2026-07-18T16:11:51+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:11:51,stderr,�[90m2026-07-18T16:11:51+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:11:51,stderr,�[90m2026-07-18T16:11:51+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mdozzle.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:11:51,stderr,�[90m2026-07-18T16:11:51+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:11:51,stderr,�[90m2026-07-18T16:11:51+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:51,stderr,�[90m2026-07-18T16:11:51+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:51,stderr,�[90m2026-07-18T16:11:51+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:11:46,stderr,�[90m2026-07-18T16:11:46+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m"50.654µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/context/user �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:46,stderr,�[90m2026-07-18T16:11:46+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m"62.438µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/context/app �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:46,stderr,�[90m2026-07-18T16:11:46+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m11.365963ms �[36mmethod=�[0mPOST �[36mpath=�[0m/api/user/logout �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:46,stderr,�[90m2026-07-18T16:11:46+02:00�[0m DBG �[1minternal/controller/user_controller.go:225�[0m�[36m >�[0m Logout attempt �[36mstream=�[0mapp

2026/07/18 16:11:46,stderr,�[90m2026-07-18T16:11:46+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:11:43,stderr,�[90m2026-07-18T16:11:43+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:11:43,stderr,�[90m2026-07-18T16:11:43+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m"125.852µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/context/user �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:43,stderr,�[90m2026-07-18T16:11:43+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:11:43,stderr,�[90m2026-07-18T16:11:43+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37618 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m"160.499µs" �[36mmethod=�[0mGET �[36mpath=�[0m/api/context/app �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:43,stderr,�[90m2026-07-18T16:11:43+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37606 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m144.034134ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m0 �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mradarr.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37607 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m144.478515ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m0 �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mradarr.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37600 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m96.119269ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m0 �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mradarr.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37598 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m108.375412ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m0 �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mradarr.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:11:41,stderr,�[90m2026-07-18T16:11:41+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m �[32mINF�[0m �[1minternal/middleware/zerolog_middleware.go:74�[0m�[36m >�[0m �[1mRequest�[0m �[36maddress=�[0m172.21.0.4:37588 �[36mclient_ip=�[0m172.21.0.4 �[36mlatency=�[0m95.555027ms �[36mmethod=�[0mGET �[36mpath=�[0m/api/auth/caddy �[36mstatus=�[0m200 �[36mstream=�[0mhttp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m0 �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mtrue �[36meffect=�[0m1 �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m DBG �[1minternal/service/policy_engine.go:108�[0m�[36m >�[0m Evaluated ACL rule �[36maccess=�[0mfalse �[36meffect=�[0m2 �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m DBG �[1minternal/service/docker_service.go:112�[0m�[36m >�[0m No matching container found for domain �[36mdomain=�[0mradarr.nasi.guanchen.nl �[36mstream=�[0mapp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:559�[0m�[36m >�[0m Request identified as coming from a browser client �[36mstream=�[0mapp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:544�[0m�[36m >�[0m Successfully got context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:541�[0m�[36m >�[0m Trying to get context from auth module 2 �[36mstream=�[0mapp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m DBG �[1minternal/controller/proxy_controller.go:530�[0m�[36m >�[0m Determined proxy type: 1 �[36mstream=�[0mapp

2026/07/18 16:11:38,stderr,�[90m2026-07-18T16:11:38+02:00�[0m DBG �[1minternal/middleware/context_middleware.go:85�[0m�[36m >�[0m Authenticated user erwinkramer via session cookie �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m �[32mINF�[0m �[1minternal/bootstrap/router_bootstrap.go:152�[0m�[36m >�[0m �[1mStarting server on http://0.0.0.0:3000�[0m �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/bootstrap/app_bootstrap.go:307�[0m�[36m >�[0m Starting database cleanup routine �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m �[33mWRN�[0m �[1minternal/controller/context_controller.go:100�[0m�[36m >�[0m �[1mUI warnings are disabled. This may lead to security issues if you are not careful. Make sure to enable warnings in production environments.�[0m �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,"�[90m2026-07-18T16:11:29+02:00�[0m �[33mWRN�[0m �[1minternal/bootstrap/router_bootstrap.go:42�[0m�[36m >�[0m �[1mTrusted proxies are not configured, IP access controls will NOT work�[0m �[36mstream=�[0mapp
"
2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/bootstrap/app_bootstrap.go:276�[0m�[36m >�[0m Configured authentication provider �[36mprovider=�[0mGitHub �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/service/oauth_broker_service.go:56�[0m�[36m >�[0m Loaded OAuth service from preset �[36mservice=�[0mgithub �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/service/docker_service.go:56�[0m�[36m >�[0m Docker connected successfully �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/bootstrap/service_bootstrap.go:114�[0m�[36m >�[0m Using Docker label provider �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/service/policy_engine.go:73�[0m�[36m >�[0m Registering ACL rule in policy engine �[36mrule=�[0mrule-ip-bypassed �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/service/policy_engine.go:73�[0m�[36m >�[0m Registering ACL rule in policy engine �[36mrule=�[0mrule-ip-allowed �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/service/policy_engine.go:73�[0m�[36m >�[0m Registering ACL rule in policy engine �[36mrule=�[0mrule-auth-enabled �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/service/policy_engine.go:73�[0m�[36m >�[0m Registering ACL rule in policy engine �[36mrule=�[0mrule-ldap-group �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/service/policy_engine.go:73�[0m�[36m >�[0m Registering ACL rule in policy engine �[36mrule=�[0mrule-oauth-group �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/service/policy_engine.go:73�[0m�[36m >�[0m Registering ACL rule in policy engine �[36mrule=�[0mrule-user-allowed �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/service/policy_engine.go:60�[0m�[36m >�[0m Using 'allow' ACL policy: access to apps will be allowed by default unless explicitly blocked �[36mstream=�[0mapp

2026/07/18 16:11:29,stderr,"�[90m2026-07-18T16:11:29+02:00�[0m DBG �[1minternal/bootstrap/app_bootstrap.go:118�[0m�[36m >�[0m No local users found, local authentication will not be available �[36mstream=�[0mapp
"
2026/07/18 16:11:29,stderr,�[90m2026-07-18T16:11:29+02:00�[0m �[32mINF�[0m �[1minternal/bootstrap/app_bootstrap.go:88�[0m�[36m >�[0m �[1mStarting Tinyauth version: v5.1.1�[0m �[36mstream=�[0mapp

  16. 14 remaining items

  17. Fla95100 commented on Jul 18, 2026

    @Fla95100
    Fla95100
    on Jul 18, 2026

    Tested now. Same result as the previous beta, no change.

    Still stuck at /continue: flow reaches /continue?redirect_uri=https%3A%2F%2Fapp.example.com%2F correctly after a successful TOTP submission (no more incorrect jump to /logout, that part stays fixed), but the automatic redirect to the target redirect_uri still never fires. No further navigation, no error.

    Network tab: every request on the /continue page returns a clean 200, including two back-to-back calls each to /api/context/app and /api/context/user (fired twice in a row, ~70-120ms each) — not sure if that duplication is expected or itself a symptom, but flagging it in case it's relevant.

    Console: checked with network/XHR noise filtered out, leaving only Errors/Warnings — nothing shown. The failure is completely silent client-side, nothing thrown that would explain why the redirect logic doesn't execute.

  18. steveiliop56 commented on Jul 18, 2026

    @steveiliop56
    steveiliop56
    on Jul 18, 2026
    Member

    @Fla95100 can you please share a screenshot?

  19. Fla95100 commented on Jul 18, 2026

    @Fla95100
    Fla95100
    on Jul 18, 2026

    For the console?

  20. steveiliop56 commented on Jul 18, 2026

    @steveiliop56
    steveiliop56
    on Jul 18, 2026
    Member

    No, of your web browser.

  21. Fla95100 commented on Jul 18, 2026

    @Fla95100
    Fla95100
    on Jul 18, 2026

    Here you have it. This is the screen I'm stuck after logging in. To come back to the app I need to manually write the address in the search bar. I also included the network tab from developer option just in case, but the console tab does not show anything.
    Image

    Let me know if there is any screen in particular you want to see.

  22. steveiliop56 commented on Jul 18, 2026

    @steveiliop56
    steveiliop56
    on Jul 18, 2026
    Member

    Yeah that's not the continue screen, it's redirecting you to the logout which means that the redirect URL is not trusted. Can you please share your logs while trying to login with TINYAUTH_LOG_LEVEL=debug?

  23. Fla95100 commented on Jul 18, 2026

    @Fla95100
    Fla95100
    on Jul 18, 2026

    2026-07-18T23:00:44Z DBG internal/controller/user_controller.go:73 > Login attempt stream=app username=flavio
    2026-07-18T23:00:45Z DBG internal/controller/user_controller.go:136 > TOTP required for user, creating pending TOTP session stream=app username=flavio
    2026-07-18T23:00:45Z INF internal/middleware/zerolog_middleware.go:74 > Request address=172.28.0.1:36160 client_ip=172.28.0.1 latency=103.433862ms method=POST path=/api/user/login status=200 stream=http
    2026-07-18T23:00:45Z DBG internal/middleware/context_middleware.go:85 > Authenticated user flavio via session cookie stream=app
    2026-07-18T23:00:45Z INF internal/middleware/zerolog_middleware.go:74 > Request address=172.28.0.1:49942 client_ip=172.28.0.1 latency="34.842µs" method=GET path=/api/context/app status=200 stream=http
    2026-07-18T23:00:45Z DBG internal/middleware/context_middleware.go:85 > Authenticated user flavio via session cookie stream=app
    2026-07-18T23:00:45Z INF internal/middleware/zerolog_middleware.go:74 > Request address=172.28.0.1:49952 client_ip=172.28.0.1 latency="399.052µs" method=GET path=/api/context/user status=200 stream=http
    2026-07-18T23:00:46Z DBG internal/middleware/context_middleware.go:85 > Authenticated user flavio via session cookie stream=app
    2026-07-18T23:00:46Z DBG internal/controller/user_controller.go:315 > TOTP verification attempt stream=app username=flavio
    2026-07-18T23:00:46Z INF internal/controller/user_controller.go:395 > TOTP verification successful, login complete stream=app username=flavio
    2026-07-18T23:00:46Z INF internal/middleware/zerolog_middleware.go:74 > Request address=172.28.0.1:49968 client_ip=172.28.0.1 latency=26.524515ms method=POST path=/api/user/totp status=200 stream=http
    2026-07-18T23:00:47Z DBG internal/middleware/context_middleware.go:85 > Authenticated user flavio via session cookie stream=app
    2026-07-18T23:00:47Z INF internal/middleware/zerolog_middleware.go:74 > Request address=172.28.0.1:49982 client_ip=172.28.0.1 latency="86.193µs" method=GET path=/api/context/app status=200 stream=http
    2026-07-18T23:00:47Z DBG internal/middleware/context_middleware.go:85 > Authenticated user flavio via session cookie stream=app
    2026-07-18T23:00:47Z INF internal/middleware/zerolog_middleware.go:74 > Request address=172.28.0.1:49994 client_ip=172.28.0.1 latency="43.783µs" method=GET path=/api/context/user status=200 stream=http
    2026-07-18T23:00:53Z DBG internal/middleware/zerolog_middleware.go:77 > Request address=127.0.0.1:56754 client_ip=127.0.0.1 latency="22.033µs" method=GET path=/api/healthz status=200 stream=http

  24. mchatzi commented on Jul 19, 2026

    @mchatzi
    mchatzi
    on Jul 19, 2026

    Seems like similar behaviour for me too, after upgrading to 5.1.0.

    The flow I'm seeing seems to match what is described here.

    GET /login?redirect_uri=...
↓
POST /api/user/login → 200 + Set-Cookie
↓
GET /totp??redirect_uri=...
↓
POST /api/user/totp → 200 + Set-Cookie
↓
Frontend JS (index-*.js)
↓
GET /logout (INSTEAD OF A REDIRECT)

    My setup used to work fine just before the upgrade (nginx, subdomains).
    The session is valid. Opening the protected application in another tab succeeds without another login. The only failure is that the SPA navigates to /logout instead of the original redirect_uri.

    Super nice app btw, thank you so much!

  25. erwinkramer commented on Jul 19, 2026

    @erwinkramer
    erwinkramer
    on Jul 19, 2026

    @Fla95100 @erwinkramer please test v5.1.2-beta.2.

    @steveiliop56
    This works for me now on beta 2. Redirecting from https to http works again like it used to. Thanks

  26. steveiliop56 commented on Jul 19, 2026

    @steveiliop56
    steveiliop56
    on Jul 19, 2026
    Member

    @mchatzi @Fla95100 I can replicate with 2FA, working on a fix.

  27. mmolitor87 commented on Jul 19, 2026

    @mmolitor87
    mmolitor87
    on Jul 19, 2026
    Author

    @steveiliop56 I can confirm v5.1.2-beta.1 works! Thank you so much!

  28. steveiliop56 commented on Jul 19, 2026

    @steveiliop56
    steveiliop56
    on Jul 19, 2026
    Member

    @mchatzi @Fla95100 please test v5.1.2-beta.3.

  29. Fla95100 commented on Jul 19, 2026

    @Fla95100
    Fla95100
    on Jul 19, 2026

    It works!! Now after login I am brought to a redirect page and then to the app.
    Thanks!

  30. steveiliop56 commented on Jul 20, 2026

    @steveiliop56
    steveiliop56
    on Jul 20, 2026
    Member

    Perfect!

  31. steveiliop56
    closed this as completedon Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions