ExternalAuth Policy with oauth2-proxy returns 401 + Location header instead of HTTP 302 redirect when authSigninURI is configured

[Sumit31]

Version

5.5.1

What Kubernetes platforms are you running on?

AKS Azure

Steps to reproduce

We are testing ExternalAuth Policy with oauth2-proxy as the authentication service.

Authentication succeeds and protected applications are accessible after login.

However, unauthenticated requests to a protected route receive an HTTP 401 response containing a Location header instead of an HTTP 302 redirect.

As a result, browsers display an intermediate "Found" page before redirecting users to the identity provider.

According to the ExternalAuth Policy documentation, when the auth service returns 401 and authSigninURI is configured, the client should be redirected into the OAuth flow.

Observed behavior appears different from that expectation.

[github-actions]

Hi @Sumit31 thanks for reporting!

Be sure to check out the docs and the Contributing Guidelines while you wait for a human to take a look at this 🙂

If your issue concerns any of the enterprise features please open a ticket with F5 directly (For NGINX Plus customers NGINX Ingress Controller (when used with NGINX Plus) is covered by the support contract.)

Cheers!

[Sumit31]

Expected behavior:
Unauthenticated request

GET /app

Expected response:

HTTP/1.1 302 Found
Location: https:///authorize...

Browser automatically follows redirect

Actual behavior

Unauthenticated request

GET /app

Actual response:

HTTP/1.1 401 Unauthorized
Location: https:///authorize...

Browser displays an intermediate page rather than performing a direct redirect.
``

policy :

apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
name: external-auth
spec:
externalAuth:
authURI: /oauth2/auth
authSigninURI: /oauth2/start
authSigninRedirectBasePath: /oauth2
authServiceName: oauth2-proxy
authServicePorts:
- 4180

route :

apiVersion: networking.k8s.io/v1
kind: Ingress

metadata:
annotations:
nginx.org/policies: external-auth

spec:
ingressClassName: nginx

rules:

• host: example.test
  http:
  paths:
  • path: /app
    pathType: Prefix

direct call :

curl -vk https://example.test/oauth2/start?rd=/app

HTTP/1.1 302 Found
Location: https:///authorize...

Tested with:

• NGINX Ingress Controller 5.5.0
• NGINX Ingress Controller 5.5.1

Same behavior observed on both versions.

We also verified that:

• oauth2-proxy auth endpoint returns 401
• oauth2-proxy signin endpoint returns 302
• authSigninURI is configured
• Policy is correctly attached to the route

Question:

Is returning HTTP 401 + Location the expected behavior for ExternalAuth Policy, or should the controller be issuing an HTTP 302 redirect when authSigninURI is configured?

[AlexFenlon]

Hi @Sumit31,

Thank you for this issue,

If you can share, can you tell us what providor you are using for your testing,

It seems like you have default config and the behaviour is as expected.

However, unauthenticated requests to a protected route receive an HTTP 401 response containing a Location header instead of an HTTP 302 redirect.

What you are saying is expected behaviour. When trying to access an oauth2 protected endpoint using curl without sending the token, the expected outcome is 401 Unauthorized

Is returning HTTP 401 + Location the expected behavior for ExternalAuth Policy,

Yes, HTTP 401 is the expected behaviour. + Location issomething we cannot see.

According to the ExternalAuth Policy documentation, when the auth service returns 401 and authSigninURI is configured, the client should be redirected into the OAuth flow.

This is correct.

During our testing we are unable to replicate the intermediate "Found" page before redirecting users to the identity provider. We were using GitHub OAuth2 provider using the https://github.com/nginx/kubernetes-ingress/tree/main/examples/ingress-resources/external-auth-mergeable example.

When we curl the endpoint we get this result, we do not see any location header attached to the 401 request and when we navigate through the broswer, it is a direct redirect to the OAuth2 Provider.

curl -ki https://cafe.example.com/coffee
HTTP/1.1 401 Unauthorized
Server: nginx/1.29.8
Date: Tue, 21 Jul 2026 15:43:00 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate, max-age=0
Expires: Thu, 01 Jan 1970 00:00:00 UTC


<!DOCTYPE html>
<html lang="en" charset="utf-8">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
    <title>Sign In</title>
    <link rel="stylesheet" href="/oauth2/static/css/bulma.min.css">

    <style>
      body {
        height: 100vh;
      }
      .sign-in-box {
        max-width: 400px;
        margin: 1.25rem auto;
      }
      .logo-box {
        margin: 1.5rem 3rem;
      }
      .alert {
        padding: 5px;
        background-color: #f44336;
        color: white;
        margin-bottom: 5px;
        border-radius: 5px
      }

      .closebtn {
        margin-left: 10px;
        color: white;
        font-weight: bold;
        float: right;
        font-size: 22px;
        line-height: 20px;
        cursor: pointer;
        transition: 0.3s;
      }

      .closebtn:hover {
        color: black;
      }
      footer a {
        text-decoration: underline;
      }
    </style>
  </head>
  <body class="has-background-light">
  <section class="section has-background-light">
    <div class="box block sign-in-box has-text-centered">

      <div class="block logo-box">
        <svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 840.55645 412.45904"><defs><style>.cls-1{fill:#333;}.cls-2{fill:#7c7c82;}.cls-3{fill:#06ed94;}.cls-4{fill:#059b61;}.cls-5{fill:#1957ba;}.cls-6{fill:#6ca8ff;}</style></defs><title>OAuth2_Proxy_logo_v3</title><path class="cls-1" d="M474.20933,196.63116a41.46679,41.46679,0,0,1-16.33506-3.18964,39.80757,39.80757,0,0,1-21.67092-21.83518,42.99409,42.99409,0,0,1,0-32.23,39.80765,39.80765,0,0,1,21.67092-21.83518,43.41665,43.41665,0,0,1,32.67012,0,39.8101,39.8101,0,0,1,21.66989,21.83518,42.994,42.994,0,0,1,0,32.23,39.81,39.81,0,0,1-21.66989,21.83518A41.485,41.485,0,0,1,474.20933,196.63116Zm0-14.07985a26.63714,26.63714,0,0,0,10.28431-1.9799,25.89889,25.89889,0,0,0,8.36072-5.50012,25.04229,25.04229,0,0,0,5.60963-8.525,31.04294,31.04294,0,0,0,0-22.11,25.07963,25.07963,0,0,0-5.60963-8.52549,25.9145,25.9145,0,0,0-8.36072-5.49961,27.6962,27.6962,0,0,0-20.56965,0,25.89233,25.89233,0,0,0-8.36072,5.49961,25.03434,25.03434,0,0,0-5.60962,8.52549,31.04279,31.04279,0,0,0,0,22.11,24.99714,24.99714,0,0,0,5.60962,8.525,25.87675,25.87675,0,0,0,8.36072,5.50012A26.63112,26.63112,0,0,0,474.20933,182.55131Z"/><path class="cls-1" d="M548.12931,116.11083h16.94044l29.59051,78.76048H578.26942L571.77961,176.061H541.41945l-6.48981,18.81033H518.53983Zm18.81032,46.3104-7.03941-19.69-2.8606-9.56994h-.88018l-2.85957,9.56994-7.04044,19.69Z"/><path class="cls-1" d="M636.67873,187.83138h-.88019a18.26469,18.26469,0,0,1-6.82039,6.43506,19.94541,19.94541,0,0,1-9.78947,2.36472q-10.23059,0-15.23483-6.26977-5.00682-6.27052-5.00527-16.7204V140.97087H613.359v30.91027q0,5.832,2.58477,8.635,2.58321,2.80482,7.53425,2.80533a10.50006,10.50006,0,0,0,5.22532-1.265,12.21407,12.21407,0,0,0,3.85029-3.41019,15.44293,15.44293,0,0,0,2.41947-5.06,22.69746,22.69746,0,0,0,.82543-6.215V140.97087H650.209v53.90044H636.67873Z"/><path class="cls-1" d="M669.01723,153.29138h-9.461V140.97087h9.461V124.471h14.4094v16.49984h13.2007v12.32051h-13.2007V174.829a15.54561,15.54561,0,0,0,.38534,3.57135,5.7936,5.7936,0,0,0,1.48454,2.77744,5.44914,5.44914,0,0,0,4.39988,1.81357,8.00547,8.00547,0,0,0,5.06-1.4303l4.07034,12.65007a23.83924,23.83924,0,0,1-5.44434,1.81512,31.8029,31.8029,0,0,1-6.43505.60487,19.66528,19.66528,0,0,1-7.31524-1.29084,15.54151,15.54151,0,0,1-5.44537-3.53675q-5.17107-5.05331-5.16953-14.37272Z"/><path class="cls-1" d="M707.735,116.11083h14.4094v22.1105l-.87915,9.79h.87915a17.85447,17.85447,0,0,1,6.65511-6.325,19.31492,19.31492,0,0,1,9.73574-2.47526q10.44909,0,15.45488,6.16026,5.00371,6.16128,5.00527,16.8299v32.67013H744.585V163.961q0-5.60962-2.64055-8.525a9.44018,9.44018,0,0,0-7.37-2.91484,10.82482,10.82482,0,0,0-5.28007,1.265,11.76092,11.76092,0,0,0-3.904,3.465,16.09429,16.09429,0,0,0-2.4205,5.11478,22.748,22.748,0,0,0-.82544,6.215v26.29034H707.735Z"/><path class="cls-1" d="M769.77353,194.87131V181.78115q6.48979-6.37824,11.98992-11.87991,2.31048-2.3097,4.73048-4.73,2.4174-2.41818,4.50939-4.50991,2.08888-2.08889,3.74078-3.795,1.6488-1.70458,2.53-2.69531,1.75726-2.08811,3.13436-3.73975a18.16413,18.16413,0,0,0,2.20046-3.24542,16.47472,16.47472,0,0,0,1.26449-3.18963,13.02445,13.02445,0,0,0,.44009-3.465,8.4276,8.4276,0,0,0-2.85956-6.325,10.93308,10.93308,0,0,0-7.81009-2.6953q-4.951,0-7.70058,2.80533a14.59773,14.59773,0,0,0-3.73975,6.325l-13.09015-5.3901a24.55547,24.55547,0,0,1,2.8606-6.105,22.76637,22.76637,0,0,1,5.06-5.61014,26.44875,26.44875,0,0,1,7.31421-4.07034,26.86184,26.86184,0,0,1,9.5157-1.59456,29.71878,29.71878,0,0,1,10.3401,1.70458,23.00883,23.00883,0,0,1,7.81008,4.67521,20.92923,20.92923,0,0,1,4.94949,6.98517,21.28551,21.28551,0,0,1,1.76037,8.635,25.00612,25.00612,0,0,1-3.465,12.92486,56.87664,56.87664,0,0,1-8.41546,10.945l-9.45992,9.46043q-3.74077,3.74077-8.47022,8.35968l.44009.66014h30.4707v12.65007Z"/><path class="cls-2" d="M447.03623,265.05824v31.9h-10.12V218.19774h26.84045a24.25664,24.25664,0,0,1,17.38054,6.82039,22.75761,22.75761,0,0,1,0,33.32974,24.22463,24.22463,0,0,1-17.38054,6.71037Zm0-37.18055v27.50059h16.94045a13.378,13.378,0,0,0,10.01054-4.07033,13.80577,13.80577,0,0,0-10.01054-23.43026Z"/><path class="cls-2" d="M507.31645,296.95821h-10.12V243.05777h9.68v8.80029h.44009a14.60805,14.60805,0,0,1,6.32451-7.31523,17.56035,17.56035,0,0,1,9.40516-3.02486,18.97706,18.97706,0,0,1,7.48054,1.31976l-3.08065,9.7905a16.79182,16.79182,0,0,0-5.94021-.77017A13.09674,13.09674,0,0,0,511.551,256.478a15.45278,15.45278,0,0,0-4.23459,10.78019Z"/><path class="cls-2" d="M530.74567,270.00825q0-12.42951,7.81009-20.57018a26.6222,26.6222,0,0,1,19.91055-8.14015q11.98785,0,19.8,8.14015,7.92011,8.14172,7.91959,20.57018,0,12.53952-7.91959,20.57017-7.81164,8.1417-19.8,8.13964a26.616,26.616,0,0,1-19.91055-8.13964Q530.74412,282.439,530.74567,270.00825Zm10.12,0q0,8.691,5.06,14.07984a17.28222,17.28222,0,0,0,25.08008,0q5.05952-5.388,5.06-14.07984,0-8.58025-5.06-13.97034a17.04544,17.04544,0,0,0-25.08008,0Q540.86469,261.429,540.86572,270.00825Z"/><path class="cls-2" d="M619.95626,269.56816l19.25041,27.39005H627.32625l-13.3102-19.91-13.09016,19.91H589.04651l19.03036-27.39005L589.4866,243.05777h11.43929l13.31021,19.03037,12.65006-19.03037h11.88042Z"/><path class="cls-2" d="M694.4248,243.05777l-33.77035,77.66076H650.20484L662.74437,293.548l-22.21949-50.49024h11.00024l16.06026,38.72036h.219l15.62017-38.72036Z"/><path class="cls-3" d="M211.931,392.63536c-101.38027,0-183.85932-82.47852-183.85932-183.8588S110.55071,24.91776,211.931,24.91776,395.7903,107.39629,395.7903,208.77656,313.31125,392.63536,211.931,392.63536Zm0-354.70389c-94.2045,0-170.84457,76.64111-170.84457,170.84509S117.72648,379.62165,211.931,379.62165s170.84457-76.6411,170.84457-170.84509S306.13548,37.93147,211.931,37.93147Z"/><polygon class="cls-4" points="244.602 112.007 239.295 131.843 281.959 166.856 322.055 161.912 244.602 112.007"/><polygon class="cls-3" points="348.449 195.562 348.449 158.734 290.209 109.179 244.602 112.007 300.209 156.67 76.642 156.67 76.642 198.05 348.449 195.562"/><polygon class="cls-5" points="180.489 297.175 185.796 277.34 141.87 240.558 103.037 247.271 180.489 297.175"/><polygon class="cls-6" points="76.642 213.62 76.642 250.448 134.882 300.004 180.489 297.175 124.882 252.512 348.449 252.512 348.449 211.132 76.642 213.62"/></svg>

      </div>


      <form method="GET" action="/oauth2/start">
        <input type="hidden" name="rd" value="/coffee">

          <button type="submit" class="button block is-primary">Sign in with GitHub</button>
      </form>





    </div>
  </section>

  <script>
    if (window.location.hash) {
      (function() {
        var inputs = document.getElementsByName('rd');
        for (var i = 0; i < inputs.length; i++) {

          var idx = inputs[i].value.indexOf('#');
          if (idx >= 0) {

            inputs[i].value = inputs[i].value.substr(0, idx);
          }
          inputs[i].value += window.location.hash;
        }
      })();
    }
  </script>

  <footer class="footer has-text-grey has-background-light is-size-7">
    <div class="content has-text-centered">

        <p>Secured with <a href="https://github.com/oauth2-proxy/oauth2-proxy#oauth2_proxy" class="has-text-grey">OAuth2 Proxy</a> version v7.15.3</p>

    </div>
        </footer>

  </body>
</html>

[Sumit31]

Hi @AlexFenlon ,

Thanks for checking.

Provider: Auth0 (OIDC)
Authentication: oauth2-proxy
NGINX Ingress Controller: 5.5.1 (also reproduced on 5.5.0)
ExternalAuth Policy

One difference I noticed is that in our environment the 401 response contains a Location header pointing directly to the IdP authorization endpoint.

Example:

HTTP/1.1 401 Unauthorized
Location: https:///authorize?...

From your example, the 401 response appears to contain the oauth2-proxy sign-in page and does not include a Location header.

In our case we are seeing the Location header in the 401 response, and in the browser users are presented with an intermediate "Found" page before reaching the IdP login page. This is the behavior we are trying to understand.

Could this difference be related to the provider configuration (Auth0 vs GitHub) or the oauth2-proxy configuration?

We're using Auth0/OIDC rather than GitHub OAuth. Is there a recommended oauth2-proxy configuration for Auth0 that you would suggest testing with ExternalAuth Policy?

Also, are there any known differences in how ExternalAuth handles:

• GitHub OAuth vs Auth0/OIDC
• oauth2-proxy sign-in pages vs direct IdP redirects

that could explain why your test case renders the oauth2-proxy sign-in page while ours returns a 401 response with a Location header?

Thanks.

[Sumit31]

Hi @AlexFenlon

Anything on this ??