Proxy outpost (Rust, 2026.8.0) sends duplicate Host header on token backchannel — nginx rejects with 400, forward auth loops (ERR_TOO_MANY_REDIRECTS)

[przwr]

Describe the bug

After upgrading to 2026.8.0 (Rust proxy outpost), OAuth code redemption fails. The browser loops endlessly (ERR_TOO_MANY_REDIRECTS): auth/nginx → 401 → /outpost.goauthentik.io/start → /application/o/authorize/ → /callback → restart.

WARN failed to redeem callback; restarting auth flow
err: HTTP status client error (400 Bad Request) for url (https://auth.example.com/application/o/token/)                                                                                                                                                                                                            
Location: src/outpost/proxy/backchannel.rs:86

nginx answers that POST with a bare 400 and an empty request line in the access log ("-" 400 157). With error_log ... info;, nginx names the cause:

[info] client sent duplicate host header: "host: auth.example.com", previous value: "host: auth.example.com" while reading client request headers, client: 10.89.0.209, server: auth.example.com, host: "auth.example.com"

So the Rust outpost sends the Host header twice on the token backchannel request. nginx (RFC 7230 — a server MUST respond 400 to a request with duplicate Host headers) rejects it before the request ever reaches authentik.

How to reproduce

1. Proxy provider in forward-auth (nginx) mode, AUTHENTIK_HOST=https://<public-host> (public URL reachable through nginx from the outpost container), 2026.8.0 on both sides.
2. Open a protected app in a fresh browser session.
3. 3. Observe the redirect loop; nginx logs client sent duplicate host header for the outpost's POST /application/o/token/.

Expected behavior

The outpost sends exactly one Host header on backchannel requests (here: src/outpost/proxy/backchannel.rs), so deployments where the outpost reaches the issuer through a strict reverse proxy keep working.###

Screenshots

No response

Additional context

Workaround: split backchannel from browser URL — AUTHENTIK_HOST=http://authentik:9000 (direct to server, no nginx in path) + AUTHENTIK_HOST_BROWSER=https://auth.example.com. Redemption then succeeds and the loop stops.

Browsers tolerate/de-duplicate duplicate Host headers, which is why the authorize flow works and only the backchannel POST fails — making this hard to diagnose from authentik logs alone.

Deployment Method

Docker

Version

2026.8.0

Relevant log output

# Outpost (proxy container), once per redirect-loop iteration:
WARN authentik::outpost::proxy::application::handlers handle_auth_callback:
  failed to redeem callback; restarting auth flow
  err: 0: HTTP status client error (400 Bad Request) for url (https://auth.example.com/application/o/token/)
  Location: src/outpost/proxy/backchannel.rs:86

# nginx access log (note empty request line "-", bare 400):
10.89.0.209 - - [19/Aug/2026:10:46:10 +0000] "-" 400 157 "-" "-"

# nginx error log with error_log info; — the actual cause:
2026/08/19 10:46:10 [info] 17#17: *18 client sent duplicate host header:
  "host: auth.example.com", previous value: "host: auth.example.com"
  while reading client request headers, client: 10.89.0.209,
  server: auth.example.com, host: "auth.example.com"

[rissson]

probably introduced by #24489

[rissson]

@przwr thanks for the detailed report. Would you be able to try out the following image: ghcr.io/goauthentik/dev-proxy:gh-4a0b876066d99a2dcc4747eb0c8abb16d0893188 and see if that fixes the issue?

[rissson]

cc. @fayak who was also running into this issue and confirmed that the link PR is indeed the solution