Accessing the NPM configuration interface via Teleport Web App: 400 Bad Request

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • No
• Are you sure you're not using someone else's docker image?
  • Yes
• Have you searched for similar issues (both open and closed)?
  • Yes

Describe the bug

I'm using the Teleport solution to manage access to the NPM web interface (port 81). The login page loads correctly, but when I try to log in by entering my username and password, (Invalid email or password) I get a 400 Bad Request error in my browser's console. After doing some research, it seems that Node.js requires very strict cookies. Teleport sends its own cookies, which causes Node.js to respond with a 400 Bad Request error in /api/tokens. Is there a way to resolve this issue?
tokens content:
Request URL
https://proxy.bastion.lanisys.fr/api/tokens
Request Method
POST
Status Code
400 Bad Request
Remote Address
176.161.185.194:443
Referrer Policy
strict-origin-when-cross-origin
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Cache-Control, Pragma, Expires, Authorization, X-Dataset-Total, X-Dataset-Offset, X-Dataset-Limit
access-control-allow-methods
OPTIONS, GET, POST
access-control-allow-origin
https://proxy.bastion.lanisys.fr
access-control-expose-headers
X-Dataset-Total, X-Dataset-Offset, X-Dataset-Limit
access-control-max-age
300
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
60
content-type
application/json; charset=utf-8
date
Sat, 04 Apr 2026 08:40:08 GMT
etag
W/"3c-9O04FcBn9iKTwnWZej/E9usc74g"
expires
0
pragma
no-cache
server
openresty
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
DENY
x-xss-protection
1; mode=block
accept
/
accept-encoding
gzip, deflate, br, zstd
accept-language
fr
connection
keep-alive
content-length
62
content-type
application/json
cookie
__Host-grv_app_session=c47677d8c758e1bc6b875da977ff9cafea6ebabfbc0b709d2eedbfb054e29770; __Host-grv_app_session_subject=95f15bdff66b3bd31d8ae425ad128d6da579e0a2b5a22b2e8e90980517e83abd
host
proxy.bastion.lanisys.fr
origin
https://proxy.bastion.lanisys.fr
referer
https://proxy.bastion.lanisys.fr/
sec-ch-ua
"Chromium";v="146", "Not-A.Brand";v="24", "Microsoft Edge";v="146"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Windows"
sec-fetch-dest
empty
sec-fetch-mode
cors
sec-fetch-site
same-origin
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0

Nginx Proxy Manager Version

2.14.0

To Reproduce
Steps to reproduce the behavior:
Not possible, specific to my setup

Operating System

NPM run on debian 13 and i test the connection on windows 10 with latest edge browser.

Start with the POST /api/tokens request described in the report and inspect the backend authentication path for how Teleport's cookies are handled. Reproduce the issue in the reported Teleport setup if possible, then verify that login succeeds without a 400 response; the report names no files or tests.