public_git
/
oauth2-proxy
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge 2427245a18 into 14af2951e5

This commit is contained in:
Mateen Anjum 2026-08-03 17:36:45 -07:00 committed by GitHub
parent 14af2951e5 2427245a18
commit c8755475ad
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@ -7,6 +7,7 @@
## Breaking Changes ## Breaking Changes
## Changes since v7.15.3 ## Changes since v7.15.3
- [#3469](https://github.com/oauth2-proxy/oauth2-proxy/pull/3469) docs: fix invalid `error_page 401 =401` in the nginx API route example and note that the shared `auth_request` config must be replicated
# V7.15.3 # V7.15.3

7
docs/docs/configuration/integrations/nginx.md
View File

@ -119,6 +119,10 @@ The named location pattern above ensures the browser receives a standard **302 r
Redirecting authentication failures (302 to `/oauth2/sign_in`) should **only be used for browser-facing routes**. API or machine clients should receive a plain 401/403 response without redirect. Redirecting authentication failures (302 to `/oauth2/sign_in`) should **only be used for browser-facing routes**. API or machine clients should receive a plain 401/403 response without redirect.
::: :::
:::note
The two snippets below show only the routing difference (redirect vs. no redirect). Replicate the rest of the `auth_request` configuration from the [main `location /` example](#configuring-for-use-with-the-nginx-auth_request-directive) above (the `auth_request_set`/`proxy_set_header` lines that pass `X-User`, `X-Email`, the access token and cookies to the backend); copying only the lines shown here omits those headers.
:::
#### Browser-facing routes (HTML, UI) #### Browser-facing routes (HTML, UI)
For interactive browser routes where users should be redirected to sign in: For interactive browser routes where users should be redirected to sign in:
@ -142,7 +146,8 @@ For API endpoints where clients expect a 401/403 status code (not a redirect):
```nginx ```nginx
location /api/ { location /api/ {
auth_request /oauth2/auth; auth_request /oauth2/auth;
error_page 401 =401; # Pass through the 401 status # No `error_page 401` directive: nginx returns the 401 from auth_request
# to the client unchanged, which is what API/machine clients expect.
proxy_pass http://backend/; proxy_pass http://backend/;
} }
``` ```