OIDC - OpenId Connect authentication fail for application behind NGINX

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  Yes
• Are you sure you're not using someone else's docker image?
  Yes
• Have you searched for similar issues (both open and closed)?
  Yes

Describe the bug
NGINX Proxy Manager is facing internet. I tried to use OpenID Connect for authentication behind it.
Internet --- NGINX proxy manager --- APISIX with openid-connect --- Web app
Keycloak is used for OIDC server.

I tried to use APISIX to manage the authentication (behind NGINX Proxy Manager) without success.
https://github.com/apache/apisix/issues/10149
We get to the conclusions that was a cookies issue with cross-site access.
But, keycloak cookie is set properly and I didn't find anywhere in NGINX Proxy Manager:
'set $session_cookie_samesite Strict;'
If I bypass NGINX Proxy Manager with ngrok tunnelling. Callback authentication works.

So, I tried with a small nodejs app directly behind the NGINX Proxy Manager to simplify the problem.
I get the same issue. Callback to the app can not be decoded properly, an information is missing.

Nginx Proxy Manager Version
v2.10.4

To Reproduce
This is the nodejs code:

const express = require('express')
const { auth } = require('express-openid-connect');
require('dotenv').config()

const path = require('path')

const app = express()
const port = process.env.NODEPORT

app.use(auth({
    issuerBaseURL: process.env.ISSUER_BASE_URL,
    clientID: process.env.CLIENT_ID,
    clientSecret: process.env.CLIENT_SECRET,
    baseURL: process.env.BASE_URL,
    secret: process.env.SECRET,
    authorizationParams: {
        response_type: 'code',
        audience: process.env.BASE_URL,
        scope: 'openid',
    },
    idpLogout: true,
    auth0Logout: true
  }))

app.use(express.static(path.join(__dirname, 'htdocs')))

app.get('/profile', async (req, res) => {
    res.send(`hello ${JSON.stringify(req.oidc.user, null, 2)}`);
});

app.listen(port, () => {
  console.log(`Server listening on port ${port}`)
})

1. go to app external URL <BASE_URL>
2. it is redirect to login page on keycloak
3. when user credential are accepted, callback to:
   <BASE_URL>/callback?state=eyJyZXR1cm5UbyI6Ii8ifQ&session_state=a7fd9407-e2c3-474c-8625-117276ed6bc0&code=a10612fc-664f-41f5-aaa3-9900d38433eb.a7fd9407-e2c3-474c-8625-117276fc6bc0.ab703194-4f67-4d9e-8a26-eff7867dc310
   and page:

502 Bad Gateway
_______________
openresty

Operating System
Linux Debian

Start by reproducing the failure with the provided Express application behind NGINX Proxy Manager v2.10.4, using the callback URL and Keycloak setup described. Compare the failing proxy path with the working ngrok path, focusing on the callback, cookies, and the reported 502 response; done means the OIDC callback completes and the application can display the authenticated profile.