Bad Request callback after upgrading from 2026.5 to 2026.8

[DcR-NL]

Every time I upgrade from 2026.5.8 to 2026.8.5 I'll eventually get hit with 400 Bad Requests on the callbacks. Clearing cookies solves it until a session expires (in practice the next day) and then I have to clear my cookies again to get past the 400. Switching back to 2026.5 solves it permanently.

I'm using a Proxy Provider in Proxy mode with basic auth enabled in combination with Nginx Proxy Manager (NPM). When I visit the desired application I see the "Redirecting to %(app)s" (the unresolved template var wasn't there on 2026.5) and right after I get the 400 Bad Request with the callback URL.

Log mentions "auth callback without a valid session cookie".

Please, does anybody know what has changed between 2026.5 and 2026.8 that I'm overlooking? Or anything I can check?

Relevant logs:

2026-10-22T19:16:05.031347083Z DBG | app=apptorent auth_via=session domain_url=auth.example.com event=PolicyAccessView user_has_access host=auth.example.com logger=authentik.policies.views pid=155 request_id=8829e738f35a4132a2676167b74529d5 result=<PolicyResult passing=True> schema_name=public timestamp=2026-10-22T19:16:05.030421 user=user 
2026-10-22T19:16:05.051082937Z DBG | auth_via=session domain_url=auth.example.com event=f(plan): starting planning process flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.planner pid=155 request_id=8829e738f35a4132a2676167b74529d5 schema_name=public timestamp=2026-10-22T19:16:05.050314 
2026-10-22T19:16:05.120120220Z DBG | auth_via=session domain_url=auth.example.com event=f(plan): taking plan from cache flow_slug=default-provider-authorization-explicit-consent host=auth.example.com key=goauthentik.io/flows/planner/ec0a626c-e8b0-414c-8cef-2c5aa48ecd14#6 logger=authentik.flows.planner pid=155 request_id=8829e738f35a4132a2676167b74529d5 schema_name=public timestamp=2026-10-22T19:16:05.119286 
2026-10-22T19:16:05.121407249Z DBG | auth_via=session domain_url=auth.example.com event=Checking if we can skip the flow executor... host=auth.example.com logger=authentik.flows.planner pid=155 request_id=8829e738f35a4132a2676167b74529d5 schema_name=public timestamp=2026-10-22T19:16:05.120798 
2026-10-22T19:16:05.275974958Z DBG | auth_via=session domain_url=auth.example.com event=Required flow executor status host=auth.example.com logger=authentik.flows.planner pid=155 request_id=8829e738f35a4132a2676167b74529d5 schema_name=public status=true timestamp=2026-10-22T19:16:05.275169 
2026-10-22T19:16:05.321536188Z INF | auth_via=session domain_url=auth.example.com event=/application/o/authorize/?client_id=lSgLbDUPiQIvelqHaFCXew0TymDIyok3gy8S5pjo&redirect_uri=https%3A%2F%2Fapp.example.com%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=ak_proxy+email+openid+entitlements+profile&state=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2xTZ0xiRFVQaVFJdmVscUhhRkNYZXcwVHltREl5b2szZ3k4UzVwam8iLCJzaWQiOiJhNTRhNzJkNS0zMjBmLTRkODctOWUxMy03YTZlNTA1YjBhOGEiLCJzdGF0ZSI6IjJlNDgyMjI2LTM0M2EtNGIwOC04N2Y0LTQzYjg4NjYxNjE5ZiIsInJlZGlyZWN0IjoiaHR0cHM6Ly9xYml0LmlpcmMubmwvIn0.Z1-Kg65GXLKi4bDvecYmqwdGgUMFfyKOpyX6IJhYP9c host=auth.example.com logger=authentik.asgi method=GET pid=155 remote=192.168.1.55 request_id=8829e738f35a4132a2676167b74529d5 runtime=671 schema_name=public scheme=https status=302 timestamp=2026-10-22T19:16:05.320691 user=user user_agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0 
2026-10-22T19:16:05.501030308Z DBG | filename=src/outpost/proxy/mod.rs line_number=228 pid=7 spans=[{"host":"app.example.com","name":"lookup_app"}] target=authentik::outpost::proxy thread_id=ThreadId(6) thread_name=tokio-3 timestamp=2026-10-22T19:16:05.499982 app=Provider for apptorent event=found app based direct host match host=app.example.com name=lookup_app 
2026-10-22T19:16:05.504734680Z DBG | filename=src/outpost/proxy/mod.rs line_number=228 pid=7 spans=[{"host":"app.example.com","name":"lookup_app"}] target=authentik::outpost::proxy thread_id=ThreadId(6) thread_name=tokio-3 timestamp=2026-10-22T19:16:05.504439 app=Provider for apptorent event=found app based direct host match host=app.example.com name=lookup_app 
2026-10-22T19:16:05.513911718Z INF | filename=packages/ak-axum/src/tracing.rs line_number=48 pid=7 spans=[{"host":"app.example.com","http_headers":"{\"user_agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0\"}","method":"GET","name":"request","path":"/sw.js","remote":"192.168.1.55","scheme":"https"}] target=authentik_axum::tracing thread_id=ThreadId(3) thread_name=tokio-0 timestamp=2026-10-22T19:16:05.513605 event=/sw.js runtime=13 status=302 host=app.example.com http_headers={"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0"} method=GET name=request path=/sw.js remote=192.168.1.55 scheme=https 
2026-10-22T19:16:05.854399270Z INF | auth_via=session domain_url=auth.example.com event=/if/flow/default-provider-authorization-explicit-consent/?client_id=lSgLbDUPiQIvelqHaFCXew0TymDIyok3gy8S5pjo&redirect_uri=https%3A%2F%2Fapp.example.com%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=ak_proxy+email+openid+entitlements+profile&state=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2xTZ0xiRFVQaVFJdmVscUhhRkNYZXcwVHltREl5b2szZ3k4UzVwam8iLCJzaWQiOiJhNTRhNzJkNS0zMjBmLTRkODctOWUxMy03YTZlNTA1YjBhOGEiLCJzdGF0ZSI6IjJlNDgyMjI2LTM0M2EtNGIwOC04N2Y0LTQzYjg4NjYxNjE5ZiIsInJlZGlyZWN0IjoiaHR0cHM6Ly9xYml0LmlpcmMubmwvIn0.Z1-Kg65GXLKi4bDvecYmqwdGgUMFfyKOpyX6IJhYP9c&inspector=available host=auth.example.com logger=authentik.asgi method=GET pid=155 remote=192.168.1.55 request_id=38e773055f014434a50784be6af67117 runtime=402 schema_name=public scheme=https status=200 timestamp=2026-10-22T19:16:05.853558 user=user user_agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0 
2026-10-22T19:16:06.101705870Z INF | filename=packages/ak-axum/src/tracing.rs line_number=48 pid=7 spans=[{"host":"auth.example.com","http_headers":"{\"user_agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0\"}","method":"GET","name":"request","path":"/files/media/public/background.jpg?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXRoIjoibWVkaWEvcHVibGljL2JhY2tncm91bmQuanBnIiwiZXhwIjoxNzkyNjk3NDY1LCJuYmYiOjE3OTI2OTY1NTB9.OcVeRnPR1w-KulPXHcjLueJHRIrx9VydRCE1wveK1tI","remote":"192.168.1.55","scheme":"https"}] target=authentik_axum::tracing thread_id=ThreadId(6) thread_name=tokio-3 timestamp=2026-10-22T19:16:06.101359 event=/files/media/public/background.jpg?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXRoIjoibWVkaWEvcHVibGljL2JhY2tncm91bmQuanBnIiwiZXhwIjoxNzkyNjk3NDY1LCJuYmYiOjE3OTI2OTY1NTB9.OcVeRnPR1w-KulPXHcjLueJHRIrx9VydRCE1wveK1tI runtime=1 status=200 host=auth.example.com http_headers={"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0"} method=GET name=request path=/files/media/public/background.jpg?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXRoIjoibWVkaWEvcHVibGljL2JhY2tncm91bmQuanBnIiwiZXhwIjoxNzkyNjk3NDY1LCJuYmYiOjE3OTI2OTY1NTB9.OcVeRnPR1w-KulPXHcjLueJHRIrx9VydRCE1wveK1tI remote=192.168.1.55 scheme=https 
2026-10-22T19:16:06.141567967Z INF | domain_url=null event=/ws/client/ logger=authentik.asgi pid=155 remote=192.168.1.55 schema_name=public scheme=ws timestamp=2026-10-22T19:16:06.140785 user_agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0 
2026-10-22T19:16:06.548792150Z DBG | auth_via=session domain_url=auth.example.com event=f(exec): Continuing existing plan flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=b926d91f56ec4c558a13cb47a415af6c schema_name=public timestamp=2026-10-22T19:16:06.547908 
2026-10-22T19:16:06.549496573Z DBG | auth_via=session binding=<FlowStageBinding: Flow-stage binding #0 to ec0a626c-e8b0-414c-8cef-2c5aa48ecd14> domain_url=auth.example.com event=f(plan_inst): stage has marker host=auth.example.com logger=authentik.flows.planner marker=ReevaluateMarker(binding=<FlowStageBinding: Flow-stage binding #0 to ec0a626c-e8b0-414c-8cef-2c5aa48ecd14>) pid=155 request_id=b926d91f56ec4c558a13cb47a415af6c schema_name=public timestamp=2026-10-22T19:16:06.548762 
2026-10-22T19:16:06.550240242Z DBG | auth_via=session binding=<FlowStageBinding: Flow-stage binding #0 to ec0a626c-e8b0-414c-8cef-2c5aa48ecd14> domain_url=auth.example.com event=f(plan_inst): running re-evaluation host=auth.example.com logger=authentik.flows.markers marker=ReevaluateMarker pid=155 policy_binding=<FlowStageBinding: Flow-stage binding #0 to ec0a626c-e8b0-414c-8cef-2c5aa48ecd14> request_id=b926d91f56ec4c558a13cb47a415af6c schema_name=public timestamp=2026-10-22T19:16:06.549601 
2026-10-22T19:16:06.639145055Z DBG | auth_via=session current_stage=<ConsentStage: Stage default-provider-authorization-consent> domain_url=auth.example.com event=f(exec): Current stage flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=b926d91f56ec4c558a13cb47a415af6c schema_name=public timestamp=2026-10-22T19:16:06.638248 
2026-10-22T19:16:06.640411734Z DBG | auth_via=session domain_url=auth.example.com event=f(exec): Passing GET flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=b926d91f56ec4c558a13cb47a415af6c schema_name=public stage=<ConsentStage: Stage default-provider-authorization-consent> timestamp=2026-10-22T19:16:06.639705 view_class=authentik.stages.consent.stage.ConsentStageView 
2026-10-22T19:16:06.657956862Z DBG | auth_via=session domain_url=auth.example.com event=f(exec): Stage ok flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=b926d91f56ec4c558a13cb47a415af6c schema_name=public stage_class=authentik.stages.consent.stage.ConsentStageView timestamp=2026-10-22T19:16:06.657149 
2026-10-22T19:16:06.662794329Z DBG | auth_via=session domain_url=auth.example.com event=f(exec): Continuing with next stage flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.views.executor pid=155 remaining=1 request_id=b926d91f56ec4c558a13cb47a415af6c schema_name=public timestamp=2026-10-22T19:16:06.662088 
2026-10-22T19:16:06.694832850Z INF | auth_via=session domain_url=auth.example.com event=/api/v3/flows/executor/default-provider-authorization-explicit-consent/?query=client_id%3DlSgLbDUPiQIvelqHaFCXew0TymDIyok3gy8S5pjo%26redirect_uri%3Dhttps%253A%252F%252Fapp.example.com%252Foutpost.goauthentik.io%252Fcallback%253FX-authentik-auth-callback%253Dtrue%26response_type%3Dcode%26scope%3Dak_proxy%2Bemail%2Bopenid%2Bentitlements%2Bprofile%26state%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2xTZ0xiRFVQaVFJdmVscUhhRkNYZXcwVHltREl5b2szZ3k4UzVwam8iLCJzaWQiOiJhNTRhNzJkNS0zMjBmLTRkODctOWUxMy03YTZlNTA1YjBhOGEiLCJzdGF0ZSI6IjJlNDgyMjI2LTM0M2EtNGIwOC04N2Y0LTQzYjg4NjYxNjE5ZiIsInJlZGlyZWN0IjoiaHR0cHM6Ly9xYml0LmlpcmMubmwvIn0.Z1-Kg65GXLKi4bDvecYmqwdGgUMFfyKOpyX6IJhYP9c%26inspector%3Davailable host=auth.example.com logger=authentik.asgi method=GET pid=155 remote=192.168.1.55 request_id=b926d91f56ec4c558a13cb47a415af6c runtime=411 schema_name=public scheme=https status=302 timestamp=2026-10-22T19:16:06.693999 user=user user_agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0 
2026-10-22T19:16:07.068628471Z DBG | auth_via=session domain_url=auth.example.com event=f(exec): Continuing existing plan flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=5928d70e2eb143aa9f890e343166499f schema_name=public timestamp=2026-10-22T19:16:07.067830 
2026-10-22T19:16:07.069302106Z DBG | auth_via=session current_stage=<Stage: In-memory Stage <class 'authentik.providers.oauth2.views.authorize.OAuthFulfillmentStage'>> domain_url=auth.example.com event=f(exec): Current stage flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=5928d70e2eb143aa9f890e343166499f schema_name=public timestamp=2026-10-22T19:16:07.068651 
2026-10-22T19:16:07.070448945Z DBG | auth_via=session domain_url=auth.example.com event=f(exec): Passing GET flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=5928d70e2eb143aa9f890e343166499f schema_name=public stage=<Stage: In-memory Stage <class 'authentik.providers.oauth2.views.authorize.OAuthFulfillmentStage'>> timestamp=2026-10-22T19:16:07.069803 view_class=authentik.providers.oauth2.views.authorize.OAuthFulfillmentStage 
2026-10-22T19:16:07.124851548Z INF | action=authorize_application auth_via=session client_ip=192.168.1.55 context={"authorized_application":{"app":"authentik_core","model_name":"application","name":"apptorent","pk":"f896b54ebbad4f7e896aeab9befab6ca"},"flow":"ec0a626ce8b0414c8cef2c5aa48ecd14","http_request":{"args":{"client_id":"lSgLbDUPiQIvelqHaFCXew0TymDIyok3gy8S5pjo","inspector":"available","redirect_uri":"https://app.example.com/outpost.goauthentik.io/callback?X-authentik-auth-callback=true","response_type":"code","scope":"ak_proxy email openid entitlements profile","state":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2xTZ0xiRFVQaVFJdmVscUhhRkNYZXcwVHltREl5b2szZ3k4UzVwam8iLCJzaWQiOiJhNTRhNzJkNS0zMjBmLTRkODctOWUxMy03YTZlNTA1YjBhOGEiLCJzdGF0ZSI6IjJlNDgyMjI2LTM0M2EtNGIwOC04N2Y0LTQzYjg4NjYxNjE5ZiIsInJlZGlyZWN0IjoiaHR0cHM6Ly9xYml0LmlpcmMubmwvIn0.Z1-Kg65GXLKi4bDvecYmqwdGgUMFfyKOpyX6IJhYP9c"},"method":"GET","path":"/api/v3/flows/executor/default-provider-authorization-explicit-consent/","request_id":"5928d70e2eb143aa9f890e343166499f","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0"},"scopes":"ak_proxy email openid entitlements profile"} domain_url=auth.example.com event=Created Event host=auth.example.com logger=authentik.events.models pid=155 request_id=5928d70e2eb143aa9f890e343166499f schema_name=public timestamp=2026-10-22T19:16:07.123952 user={"email":"iot+authentik@example.com","pk":6,"username":"user"} 
2026-10-22T19:16:07.144901678Z DBG | auth_via=session domain_url=auth.example.com event=Enqueueing message on queue host=auth.example.com logger=django_dramatiq_postgres.broker message_id=01095d90-077e-4289-af99-742500f45922 pid=155 queue=default request_id=5928d70e2eb143aa9f890e343166499f schema_name=public timestamp=2026-10-22T19:16:07.144088 
2026-10-22T19:16:07.257113299Z INF | auth_via=session domain_url=auth.example.com event=Task enqueued host=auth.example.com logger=authentik.tasks.middleware pid=155 request_id=5928d70e2eb143aa9f890e343166499f schema_name=public task_id=01095d90-077e-4289-af99-742500f45922 task_name=authentik.events.tasks.event_trigger_dispatch timestamp=2026-10-22T19:16:07.256300 
2026-10-22T19:16:07.387916942Z DBG | auth_via=session domain_url=auth.example.com event=f(exec): Stage ok flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=5928d70e2eb143aa9f890e343166499f schema_name=public stage_class=authentik.providers.oauth2.views.authorize.OAuthFulfillmentStage timestamp=2026-10-22T19:16:07.384876 
2026-10-22T19:16:07.389351630Z DBG | auth_via=session context={"consent":"<UserConsent: User Consent f896b54e-bbad-4f7e-896a-eab9befab6ca by 6>","consent_header":"You're about to sign into apptorent.","consent_permissions":[{"id":"ak_proxy","name":"authentik Proxy - User information"},{"id":"email","name":"Email address"},{"id":"entitlements","name":"Application entitlements"},{"id":"openid","name":""},{"id":"profile","name":"General Profile Information"}],"is_sso":true} domain_url=auth.example.com event=f(exec): User passed all stages flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=5928d70e2eb143aa9f890e343166499f schema_name=public timestamp=2026-10-22T19:16:07.388449 
2026-10-22T19:16:07.390071634Z DBG | auth_via=session domain_url=auth.example.com event=f(exec): cleaning up flow_slug=default-provider-authorization-explicit-consent host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=5928d70e2eb143aa9f890e343166499f schema_name=public timestamp=2026-10-22T19:16:07.389469 
2026-10-22T19:16:07.391557085Z DBG | auth_via=session current=/api/v3/flows/executor/default-provider-authorization-explicit-consent/ domain_url=auth.example.com event=converting to redirect challenge host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=5928d70e2eb143aa9f890e343166499f schema_name=public timestamp=2026-10-22T19:16:07.390928 to=/ 
2026-10-22T19:16:07.394120561Z DBG | auth_via=session current=/api/v3/flows/executor/default-provider-authorization-explicit-consent/ domain_url=auth.example.com event=converting to redirect challenge host=auth.example.com logger=authentik.flows.views.executor pid=155 request_id=5928d70e2eb143aa9f890e343166499f schema_name=public timestamp=2026-10-22T19:16:07.393495 to=https://app.example.com/outpost.goauthentik.io/callback?X-authentik-auth-callback=true&code=95731d7512dd4d7aa8c6e0c60e4fac6b&state=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2xTZ0xiRFVQaVFJdmVscUhhRkNYZXcwVHltREl5b2szZ3k4UzVwam8iLCJzaWQiOiJhNTRhNzJkNS0zMjBmLTRkODctOWUxMy03YTZlNTA1YjBhOGEiLCJzdGF0ZSI6IjJlNDgyMjI2LTM0M2EtNGIwOC04N2Y0LTQzYjg4NjYxNjE5ZiIsInJlZGlyZWN0IjoiaHR0cHM6Ly9xYml0LmlpcmMubmwvIn0.Z1-Kg65GXLKi4bDvecYmqwdGgUMFfyKOpyX6IJhYP9c 
2026-10-22T19:16:07.420865788Z INF | auth_via=session domain_url=auth.example.com event=/api/v3/flows/executor/default-provider-authorization-explicit-consent/?query=client_id%3DlSgLbDUPiQIvelqHaFCXew0TymDIyok3gy8S5pjo%26redirect_uri%3Dhttps%253A%252F%252Fapp.example.com%252Foutpost.goauthentik.io%252Fcallback%253FX-authentik-auth-callback%253Dtrue%26response_type%3Dcode%26scope%3Dak_proxy%2Bemail%2Bopenid%2Bentitlements%2Bprofile%26state%3DeyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2xTZ0xiRFVQaVFJdmVscUhhRkNYZXcwVHltREl5b2szZ3k4UzVwam8iLCJzaWQiOiJhNTRhNzJkNS0zMjBmLTRkODctOWUxMy03YTZlNTA1YjBhOGEiLCJzdGF0ZSI6IjJlNDgyMjI2LTM0M2EtNGIwOC04N2Y0LTQzYjg4NjYxNjE5ZiIsInJlZGlyZWN0IjoiaHR0cHM6Ly9xYml0LmlpcmMubmwvIn0.Z1-Kg65GXLKi4bDvecYmqwdGgUMFfyKOpyX6IJhYP9c%26inspector%3Davailable host=auth.example.com logger=authentik.asgi method=GET pid=155 remote=192.168.1.55 request_id=5928d70e2eb143aa9f890e343166499f runtime=590 schema_name=public scheme=https status=200 timestamp=2026-10-22T19:16:07.419980 user=user user_agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0 
2026-10-22T19:16:07.443049312Z DBG | filename=src/outpost/proxy/mod.rs line_number=228 pid=7 spans=[{"host":"app.example.com","name":"lookup_app"}] target=authentik::outpost::proxy thread_id=ThreadId(3) thread_name=tokio-0 timestamp=2026-10-22T19:16:07.441607 app=Provider for apptorent event=found app based direct host match host=app.example.com name=lookup_app 
2026-10-22T19:16:07.443122321Z DBG | filename=src/outpost/proxy/application/handlers/mod.rs line_number=53 pid=7 spans=[{"host":"app.example.com","http_headers":"{\"user_agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0\"}","method":"GET","name":"request","path":"/outpost.goauthentik.io/callback?X-authentik-auth-callback=true&code=95731d7512dd4d7aa8c6e0c60e4fac6b&state=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2xTZ0xiRFVQaVFJdmVscUhhRkNYZXcwVHltREl5b2szZ3k4UzVwam8iLCJzaWQiOiJhNTRhNzJkNS0zMjBmLTRkODctOWUxMy03YTZlNTA1YjBhOGEiLCJzdGF0ZSI6IjJlNDgyMjI2LTM0M2EtNGIwOC04N2Y0LTQzYjg4NjYxNjE5ZiIsInJlZGlyZWN0IjoiaHR0cHM6Ly9xYml0LmlpcmMubmwvIn0.Z1-Kg65GXLKi4bDvecYmqwdGgUMFfyKOpyX6IJhYP9c","remote":"192.168.1.55","scheme":"https"},{"name":"handle"}] target=authentik::outpost::proxy::application::handlers thread_id=ThreadId(3) thread_name=tokio-0 timestamp=2026-10-22T19:16:07.442029 event=handling OAuth Callback from querystring signature name=handle 
2026-10-22T19:16:07.443206494Z WRN | filename=src/outpost/proxy/application/handlers/mod.rs line_number=226 pid=7 spans=[{"host":"app.example.com","http_headers":"{\"user_agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:158.0) Gecko/20100101 Firefox/158.0\"}","method":"GET","name":"request","path":"/outpost.goauthentik.io/callback?X-authentik-auth-callback=true&code=95731d7512dd4d7aa8c6e0c60e4fac6b&state=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnb2F1dGhlbnRpay5pby9vdXRwb3N0L2xTZ0xiRFVQaVFJdmVscUhhRkNYZXcwVHltREl5b2szZ3k4UzVwam8iLCJzaWQiOiJhNTRhNzJkNS0zMjBmLTRkODctOWUxMy03YTZlNTA1YjBhOGEiLCJzdGF0ZSI6IjJlNDgyMjI2LTM0M2EtNGIwOC04N2Y0LTQzYjg4NjYxNjE5ZiIsInJlZGlyZWN0IjoiaHR0cHM6Ly9xYml0LmlpcmMubmwvIn0.Z1-Kg65GXLKi4bDvecYmqwdGgUMFfyKOpyX6IJhYP9c","remote":"192.168.1.55","scheme":"https"},{"name":"handle"},{"name":"handle_auth_callback"}] target=authentik::outpost::proxy::application::handlers thread_id=ThreadId(3) thread_name=tokio-0 timestamp=2026-10-22T19:16:07.442107 event=auth callback without a valid session cookie name=handle_auth_callback 

[dewi-tik]

Seems to be related to #26447

Which has a linked PR that might resolve this