[Bug]: Wrong Redirect/Landing Page in combination with Authentik for SSO authentication

Is there an existing issue for this?

• I have searched the existing issues

OS/Web Information

• Web Browser: Tested with Firefox 102.0.1 and Google Chrome 103.0.5060.114
• Local OS: Arch Linux
• Remote OS: Debian GNU/Linux 10 (buster) (LXC Container)
• Remote Architecture: AMD64
• code-server --version: 4.4.0 b088ec7adf9e17bc75215f79e21498eb40da03ed with Code 1.66.2

Steps to Reproduce

1. Install code-server
2. (Optional?) Disable Password authentication in code-server
3. Setup Authentik (https://github.com/goauthentik/authentik)
4. Setup an application + provider for code-server
5. Assign the code-server application in Authentik to the Proxy outpost
6. Configure Nginx to act as a reverse proxy for code-server and to use Authentik for authentication
7. Navigate to your code-server instance in your browser

Expected

When you navigate to code.domain.tld you should get redirected to Authenik where you need to log in with your Authentik details. After that you should get redirected back to code.domain.tld.

Actual

When you navigate to https://code.domain.tld you get redirected to Authenik where you need to log in with your Authentik details. After that you get redirected back to https://code.domain.tld/_static/out/browser/serviceWorker.js. You then need to open https://code.domain.tld again and it all works fine. This is especially annoying if you also use the PWA (Google Chrome), where you then have to close and reopen the window.

Logs

No response

Screenshot/Video

No response

Does this issue happen in VS Code or GitHub Codespaces?

• I cannot reproduce this in VS Code.
• I cannot reproduce this in GitHub Codespaces.

Are you accessing code-server over HTTPS?

• I am using HTTPS.

Notes

I do use the same configuration for other self hosted web services (rTorrent, Radarr, Sonarr, Lidarr, Prowlarr, PiHole), with only changes to the domain name. So I would assume that the Authenik configuration is correct. I have no clue if that issue is maybe on Authentiks side, that is possible too. Though it is weird that I end up on a site from code-server which actually exists. This makes me believe that this is a code-server issue?

If needed I can of course post my full nginx configurations.

[marissa999]

Hmm I do not think I had that issue 🤔 Without knowing much more I would just blame your nginx setup and recommend you to check the nginx logs 🤔 In my experience nginx throws a 500 most of the time bc it couldnt reach the destination that it should proxy.

[TerenceLiu98]

@marissa999 I tried the combination of authentik (forward auth) and code-server (both of them are in docker with nginx for reverse proxy) however, once I add the authentik’s forward auth nginx setup, the code-server URL goes to 500 internal Server Error. I wonder if you have met this situation before 😃