goauthentik / goauthentik/authentik
/media/ subdirectory does not route to proxy when using embedded outpost
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 659
Description
**Describe the bug**
When an application and provider are set up to proxy an application (in this case, "copyparty"), attempts to access `/media/` are rebuffed.
**To Reproduce**
1. Set up a Proxy Provider in Authentik 2025.6.4 to forward an external URL to an internal URL (in my case, `https://copyparty.my.domain` to `http://1.2.3.4:3923`)
2. Set up an Application to match
3. Visit the proxied URL and see that it works
4. Visit the `/media/` path and see that it returns a 404
**Expected behavior**
Whatever is on the `/media/` path to be returned, or the proxied application to return a 404.
**Screenshots**
N/A
**Logs**
Logs while the shared folder in question is named 'media':
```
{"event":"/media/","host":"copyparty.my.domain","level":"info","logger":"authentik.router","method":"GET","remote":"1.2.3.4","runtime":"0.144","scheme":"http","size":19,"status":404,"timestamp":"2025-07-28T22:25:14Z","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"}
```
Logs after renaming the shared folder to `mediaa`:
```
darkplace:~# docker logs --since 1s -f idp-server-1 2>&1 | grep media
{"event":"/mediaa/","host":"copyparty.my.domain","level":"info","logger":"authentik.outpost.proxyv2.application","method":"GET","name":"Copyparty-LAN","remote":"1.2.3.4","runtime":"42.409","scheme":"http","size":15171,"status":200,"timestamp":"2025-07-28T22:34:23Z","user":"maff","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"}
{"event":"/mediaa/?tree=","host":"copyparty.my.domain","level":"info","logger":"authentik.outpost.proxyv2.application","method":"GET","name":"Copyparty-LAN","remote":"1.2.3.4","runtime":"4.707","scheme":"http","size":387,"status":200,"timestamp":"2025-07-28T22:34:23Z","user":"maff","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"}
```
**Version and Deployment (please complete the following information):**
- authentik version: 2025.6.4
- Deployment: docker-compose
**Additional context**
I believe this is similar or potentially the same as #14463 which was closed by the stale bot without response.
Given that a 404 returned from the proxied application is logged via `authentik.outpost.proxyv2.application` while the 404 returned for `/media/` is logged by `authentik.router`, I think this route is being handled by an overly-eager route definition. A quick grep doesn't turn up much - maybe in `authentik/lib/default.yml` where it defines the storage endpoint, or in `internal/web/static.go` which hard-codes a `/media/` URL, but I don't know.
Of note is that `/media`, without the trailing forward-slash, does get proxied, but the application I'm accessing then tries to access `/media/?tree`, which hits this eager route, and never reaches the proxied application.
Contributor guide
Assessment
This issue has not been assessed yet.