Bug Report: OAuth source redirect_uri uses application domain instead of AUTHENTIK_HOST when accessed via Proxy Provider

[brianmiller]

This may be related to #19878

Describe the bug

After upgrading from Authentik 2025.12.1 to 2025.12.2, OAuth authentication with Google fails with a redirect_uri_mismatch error when users are redirected from applications using Proxy Providers. The issue occurs because Authentik is incorrectly using the application domain (e.g., app1.mydomain.com, app2.mydomain.com) instead of the Authentik domain (login.mydomain.com) when constructing the OAuth callback redirect_uri.

Important: This issue only affects authentication flows initiated from Proxy Provider applications. Direct OIDC provider applications work correctly.

Reproduction

Environment

• Authentik Version: 2025.12.2
• Deployment: Docker Compose
• OAuth Provider: Google
• Setup: Multiple applications using Authentik for authentication via proxy providers

Steps to Reproduce

1. Upgrade Authentik from 2025.12.1 to 2025.12.2
2. Have a Google OAuth source configured in Authentik
3. Configure an application with a Proxy Provider (using built-in outpost)
4. Access the application protected by the Proxy Provider (e.g., app1.mydomain.com)
5. Get redirected to Authentik login page (login.mydomain.com)
6. Click "Sign in with Google"
7. Observe the error from Google

Note: Applications using OIDC providers directly (not Proxy Providers) are NOT affected and work correctly.

Configuration

Environment variables are correctly set:

AUTHENTIK_HOST=https://login.mydomain.com
AUTHENTIK_HOST_BROWSER=https://login.mydomain.com

Proxy Provider Configuration:

• Provider Type: Proxy Provider
• External Host: https://app1.mydomain.com (example)
• Internal Host: https://app1.mydomain.com
• Mode: Proxy
• Using: Built-in Outpost

Google OAuth source callback URL in Authentik:

https://login.mydomain.com/source/oauth/callback/google/

Google Cloud Console Authorized redirect URI:

https://login.mydomain.com/source/oauth/callback/google/

Expected behavior

Authentik should send the OAuth callback redirect_uri as:

https://login.mydomain.com/source/oauth/callback/google/

This is the configured AUTHENTIK_HOST and matches what's registered in Google Cloud Console.

Actual behavior

Authentik is sending the redirect_uri as:

https://app1.mydomain.com/source/oauth/callback/google/

or

https://app2.mydomain.com/source/oauth/callback/google/

The application domain is being used instead of the Authentik domain, causing Google to reject the request with:

Error 400: redirect_uri_mismatch
You can't sign in to this app because it doesn't comply with Google's OAuth 2.0 policy.

Screenshots

Error from Google showing incorrect redirect_uri

The error clearly shows Authentik sent redirect_uri=https://app1.mydomain.com/source/oauth/callback/google/ instead of the expected https://login.mydomain.com/source/oauth/callback/google/

Google OAuth Error (sanitized)

Note: Screenshot should be attached showing the Google error with the full redirect_uri

Authentik Configuration

• OAuth Source shows correct callback URL: https://login.mydomain.com/source/oauth/callback/google/
• Environment variables confirm AUTHENTIK_HOST=https://login.mydomain.com

Impact

• Severity: Critical for Proxy Provider users
• Scope: OAuth authentication fails for all applications using Proxy Providers with built-in outpost
• Affected Users: Users of applications protected by Proxy Providers who authenticate via OAuth sources (e.g., Google, GitHub, etc.)
• Not Affected: Applications using OIDC providers directly continue to work normally

Workaround

Rolling back to version 2025.12.1 resolves the issue immediately:

# In docker-compose.yml:
image: ghcr.io/goauthentik/server:2025.12.1

docker-compose down
docker-compose up -d

Additional Context

• This is a regression introduced in 2025.12.2
• The issue specifically affects OAuth source authentication when accessed via Proxy Provider flows
• OIDC provider applications (non-proxy) work correctly
• All applications using Proxy Providers with OAuth sources are affected
• The configuration was working correctly in 2025.12.1
• The issue appears to be in how the Proxy Provider passes request context to the OAuth source flow

Version and Deployment

• Authentik Version: 2025.12.2
• Build hash/commit: f6f2f6c
• Deployment: Docker Compose
• Reverse Proxy: Cloudflare Tunnel

Logs

(If available, logs showing the OAuth flow would be helpful here)

Suggested Fix

The OAuth source callback URL generation logic should use AUTHENTIK_HOST / AUTHENTIK_HOST_BROWSER environment variables consistently, even when the authentication flow originates from a Proxy Provider application. The request context from the proxy application should not influence the OAuth callback URL construction.

[exu-g]

Looks like this is working again with 2025.12.4

[BeryJu]

The only cause for this I could think of was a bug involving authentication flows (#19615)

[authentik-automation]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.