David Pinkerton on Nostr: Spent an afternoon debugging why Caddy's forward_auth wasn't passing group headers ...
Spent an afternoon debugging why Caddy's forward_auth wasn't passing group headers from oauth2-proxy when calling it over HTTPS across networks.
The fix was one line: header_up Host oauth2-proxy.example.com
Without it, Caddy sends the original request's Host header, oauth2-proxy's cookie validation gets confused, and X-Auth-Request-Groups silently disappears.
Wrote it up:
https://blog.dpinkerton.com/posts/caddy-forward-auth-host-header/Published at
2026-01-31 12:43:21 UTCEvent JSON
{
"id": "b30702fab3fbf84ef95cc5290d9ae848bb55120d799deb3753b730a98e056e0b",
"pubkey": "909e3fdc259a211ead564dc589e34a81aef214665d5e6889ef8bb6d473f2b10a",
"created_at": 1769863401,
"kind": 1,
"tags": [],
"content": "Spent an afternoon debugging why Caddy's forward_auth wasn't passing group headers from oauth2-proxy when calling it over HTTPS across networks.\nThe fix was one line: header_up Host oauth2-proxy.example.com\nWithout it, Caddy sends the original request's Host header, oauth2-proxy's cookie validation gets confused, and X-Auth-Request-Groups silently disappears.\nWrote it up: https://blog.dpinkerton.com/posts/caddy-forward-auth-host-header/",
"sig": "53fa0b98ca386b2c1b1c6d7992cad6ae26364bf790074291571c13bc432e7395860e76ad807e539965254bba1269e2629bdc0f1c9b292de4ddec2a3529413d4c"
}
