Skip to content

Conversation

@murataslan1
Copy link
Contributor

What does this PR do?

When the ForwardAuth middleware fails to reach the authentication server, it returns a 500 error but logs at DEBUG level, making it difficult to diagnose issues in production without enabling debug logging.

This change promotes the error log to ERROR level for better observability.

Motivation

As reported in #12234, when the ForwardAuth middleware cannot reach the auth server (e.g., DNS resolution failure, network issues), users receive 500 errors with no indication in logs unless DEBUG level is enabled. This makes troubleshooting production issues very difficult.

Example log before this change:

2025-11-04T11:22:57Z DBG github.com/traefik/traefik/v3/pkg/middlewares/auth/forward.go:196 > Error calling <host>:8080/v0/auth:check error="..." 

Example log after this change:

2025-11-04T11:22:57Z ERR github.com/traefik/traefik/v3/pkg/middlewares/auth/forward.go:196 > Error calling <host>:8080/v0/auth:check error="..."

Changes

  • Changed log level from Debug() to Error() in pkg/middlewares/auth/forward.go line 198

Fixes #12234

@kevinpollet kevinpollet changed the title fix(middleware): change ForwardAuth error log level from DEBUG to ERROR Change ForwardAuth error log level from DEBUG to ERROR Dec 1, 2025
Copy link
Contributor

@nmengin nmengin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your contribution @murataslan1.

As it's a bugfix, could you rebase the PR on the branch v3.6 to allow us to merge it please?

@murataslan1 murataslan1 force-pushed the fix/forwardauth-error-log-level branch from c0ad4de to 32f5d89 Compare December 1, 2025 18:11
@murataslan1 murataslan1 changed the base branch from master to v3.6 December 2, 2025 05:11
@murataslan1
Copy link
Contributor Author

Done! I've changed the base branch to v3.6. The PR is now ready for merge.

@mmatur mmatur added this to the 3.6 milestone Dec 4, 2025
When the ForwardAuth middleware fails to reach the authentication server,
it returns a 500 error but logs at DEBUG level, making it difficult to
diagnose issues in production without enabling debug logging.

This change promotes the error log to ERROR level for better observability.

Fixes traefik#12234
@mmatur mmatur force-pushed the fix/forwardauth-error-log-level branch from 32f5d89 to 87904cf Compare December 4, 2025 13:27
Copy link
Member

@mmatur mmatur left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@traefiker
Copy link
Contributor

🚫 the mergeable state is "blocked"

@traefiker traefiker merged commit c3d428a into traefik:v3.6 Dec 4, 2025
45 of 51 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ForwardAuth middleware: why errors (500) logs use DEBUG level (instead of ERROR)?

6 participants