goauthentik / goauthentik/authentik

/media/ subdirectory does not route to proxy when using embedded outpost

Open
#15,843 4 comments 0 reactions 0 assignees View on GitHub
area:backend bug status/reviewing
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
659

Description

**Describe the bug**
When an application and provider are set up to proxy an application (in this case, "copyparty"), attempts to access `/media/` are rebuffed.

**To Reproduce**

1. Set up a Proxy Provider in Authentik 2025.6.4 to forward an external URL to an internal URL (in my case, `https://copyparty.my.domain` to `http://1.2.3.4:3923`)
2. Set up an Application to match
3. Visit the proxied URL and see that it works
4. Visit the `/media/` path and see that it returns a 404

**Expected behavior**
Whatever is on the `/media/` path to be returned, or the proxied application to return a 404.

**Screenshots**
N/A

**Logs**
Logs while the shared folder in question is named 'media':
```
{"event":"/media/","host":"copyparty.my.domain","level":"info","logger":"authentik.router","method":"GET","remote":"1.2.3.4","runtime":"0.144","scheme":"http","size":19,"status":404,"timestamp":"2025-07-28T22:25:14Z","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"}
```

Logs after renaming the shared folder to `mediaa`:
```
darkplace:~# docker logs --since 1s -f idp-server-1 2>&1 | grep media
{"event":"/mediaa/","host":"copyparty.my.domain","level":"info","logger":"authentik.outpost.proxyv2.application","method":"GET","name":"Copyparty-LAN","remote":"1.2.3.4","runtime":"42.409","scheme":"http","size":15171,"status":200,"timestamp":"2025-07-28T22:34:23Z","user":"maff","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"}
{"event":"/mediaa/?tree=","host":"copyparty.my.domain","level":"info","logger":"authentik.outpost.proxyv2.application","method":"GET","name":"Copyparty-LAN","remote":"1.2.3.4","runtime":"4.707","scheme":"http","size":387,"status":200,"timestamp":"2025-07-28T22:34:23Z","user":"maff","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"}
```

**Version and Deployment (please complete the following information):**

- authentik version: 2025.6.4
- Deployment: docker-compose

**Additional context**
I believe this is similar or potentially the same as #14463 which was closed by the stale bot without response.

Given that a 404 returned from the proxied application is logged via `authentik.outpost.proxyv2.application` while the 404 returned for `/media/` is logged by `authentik.router`, I think this route is being handled by an overly-eager route definition. A quick grep doesn't turn up much - maybe in `authentik/lib/default.yml` where it defines the storage endpoint, or in `internal/web/static.go` which hard-codes a `/media/` URL, but I don't know.

Of note is that `/media`, without the trailing forward-slash, does get proxied, but the application I'm accessing then tries to access `/media/?tree`, which hits this eager route, and never reaches the proxied application.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.