dtoro a239cece10 fix(sidecar): stop blocking Authentik OIDC login on the scoped proxy ...

The scoped /api/v1 proxy let unauthenticated traffic through for a
guessed "oauth/" path prefix, but PhotoPrism's actual OIDC routes are
/api/v1/oidc/login and /api/v1/oidc/redirect. The Authentik callback
(oidc/redirect) has no session token yet — it IS what establishes one —
so it fell through to the authenticated branch and got rejected with
401 "invalid session" before the session existed. Since the sidecar
registers /api/v1/*rest as the catch-all for all PhotoPrism API
traffic, this broke SSO login entirely.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-04 13:30:33 +02:00

12 KiB

Raw Blame History

View Raw