Proxy Providers Infinite Redirect Loop

### Describe the bug

All of my proxy providers are suddenly hitting an infinite redirect loop when I try to access them. They were all working a few days ago, and I haven't changed anything except a recent-ish update to 2026.5.3; though things seemed to initially be working then.

OIDC providers work fine.
The authentik subdomain works fine.
The issue is browser-agnostic; happens in both Chrome + Firefox, in incognito or not.
Clearing cache/cookies does nothing.
Restarting my stack (and the device it runs on) does nothing.

### How to reproduce

1. Attempt to reach any proxy provider with single-url forward auth by browser
2. Run into infinite redirect error

### Expected behavior

Reach that subdomain

### Screenshots

_No response_

### Additional context

Environment
OS: Pop!_OS 24.04 LTS x86_64

```
λ uname -a
Linux bubble 6.18.7-76061807-generic #202601231045~1778249322~24.04~b44a3c3 SMP PREEMPT_DYNAMIC Fri M x86_64 x86_64 x86_64 GNU/Linux

λ docker compose version
Docker Compose version v5.1.4
```

Authentik Server and Worker versions: 2026.5.3
DNS: Cloudflare
Reverse Proxy: SWAG (essentially Nginx under the hood)

Reverse Proxy config:
`authentik-location.conf`:
```
## Version 2023/04/27 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-location.conf.sample
# Make sure that your authentik container is in the same user defined bridge network and is named authentik-server
# Rename /config/nginx/proxy-confs/authentik.subdomain.conf.sample to /config/nginx/proxy-confs/authentik.subdomain.conf

## Send a subrequest to Authentik to verify if the user is authenticated and has permission to access the resource
auth_request /outpost.goauthentik.io/auth/nginx;

## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal
error_page 401 = @goauthentik_proxy_signin;

## Translate the user information response headers from the auth subrequest into variables
auth_request_set $authentik_email $upstream_http_x_authentik_email;
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
auth_request_set $authentik_name $upstream_http_x_authentik_name;
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
auth_request_set $authentik_username $upstream_http_x_authentik_username;

## Inject the user information into the request made to the actual upstream
proxy_set_header X-authentik-email $authentik_email;
proxy_set_header X-authentik-groups $authentik_groups;
proxy_set_header X-authentik-name $authentik_name;
proxy_set_header X-authentik-uid $authentik_uid;
proxy_set_header X-authentik-username $authentik_username;

## Translate the Set-Cookie response header from the auth subrequest into a variable
auth_request_set $set_cookie $upstream_http_set_cookie;
```

`authentik-server.conf`:
```
## Version 2025/03/25 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/authentik-server.conf.sample
# Make sure that your authentik container is in the same user defined bridge network and is named authentik-server
# Rename /config/nginx/proxy-confs/authentik.subdomain.conf.sample to /config/nginx/proxy-confs/authentik.subdomain.conf

# location for authentik subfolder requests
location ^~ /outpost.goauthentik.io {
auth_request off; # requests to this subfolder must be accessible without authentication

include /config/nginx/proxy.conf;
include /config/nginx/resolver.conf;
set $upstream_authentik authentik-server;
proxy_pass http://$upstream_authentik:9000;
}

# location for authentik auth requests
location = /outpost.goauthentik.io/auth/nginx {
internal;

include /config/nginx/proxy.conf;
include /config/nginx/resolver.conf;
set $upstream_authentik authentik-server;
proxy_pass http://$upstream_authentik:9000/outpost.goauthentik.io/auth/nginx;

## Include the Set-Cookie header if present
auth_request_set $set_cookie $upstream_http_set_cookie;
add_header Set-Cookie $set_cookie;

proxy_pass_request_body off;
proxy_set_header Content-Length "";
}

# virtual location for authentik 401 redirects
location @goauthentik_proxy_signin {
internal;

## Include the Set-Cookie header if present
auth_request_set $set_cookie $upstream_http_set_cookie;
add_header Set-Cookie $set_cookie;

## Set the $target_url variable based on the original request
set_escape_uri $target_url $scheme://$http_host$request_uri;

## Set the $signin_url variable
set $signin_url https://$http_host/outpost.goauthentik.io/start?rd=$target_url;

## Redirect to login
return 302 $signin_url;
}
```

Example site conf file:
```
server {
listen 443 ssl;
# listen 443 quic;
listen [::]:443 ssl;
# listen [::]:443 quic;

server_name aurral.*;

include /config/nginx/ssl.conf;

client_max_body_size 0;

# enable for Authentik (requires authentik-location.conf in the location block)
include /config/nginx/authentik-server.conf;

# Maxmind Geoblocking (edit whitelist in /nginx/maxmind.conf)
if ($lan-ip = yes) { set $geo-whitelist yes; }
if ($geo-whitelist = no) { return 404; }

location / {
# enable for Authentik (requires authentik-server.conf in the server block)
include /config/nginx/authentik-location.conf;

include /config/nginx/proxy.conf;
include /config/nginx/resolver.conf;
set $upstream_app aurral;
set $upstream_port 3001;
set $upstream_proto http;
proxy_pass $upstream_proto://$upstream_app:$upstream_port;

# REMOVE THIS LINE BEFORE SUBMITTING: Additional proxy settings such as headers go below this line, leave the blank line above.
}
}
```

### Deployment Method

Docker

### Version

2026.5.3

### Relevant log output

```shell
Will post in separate post due to character length limit
```

Start with the supplied authentik-location.conf and authentik-server.conf snippets, then review the example site configuration and the reported reproduction steps. Trace the auth_request and 401 redirect flow for a proxy provider using single-url forward auth. Done means the provider subdomain loads without an infinite redirect loop while OIDC providers and the authentik subdomain continue to work.

Written by the indexing model from the issue text.