goauthentik / goauthentik/authentik
Proxy Provider causes HTTP 400 error with IIS on HTTP/2
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 659
Description
### Describe the bug
On Authentik 2026.8 the Proxy Provider while in proxy mode seems to break when proxying to a webpage that has HTTP/2 enabled. The error that was received on IIS is
Bad Request
HTTP Error 400. The request is badly formed.
Unsure if this is happening on every HTTP/2 connection or just IIS ones. On my Authentik instance we have NGINX acting as a proxy for Authentik, however prior to update 2026.8 we had no issues with this.
### How to reproduce
1. Configure a new application with Proxy as the provider
2. In the provider section set it to proxy, not the Forward Auth options
3. Configure external host however you want and for the internal host make sure that it is a http/2 webpage
4. Bind the provider to the necessary outpost
5. Attempt to reach the webapp and you should receive the HTTP 400 error
### Expected behavior
Expected for the proxy to work as intended and continue on to the website instead of receiving a 400 error.
### Screenshots
_No response_
### Additional context
_No response_
### Deployment Method
Docker
### Version
2026.8
### Relevant log output
```shell
```
Contributor guide
Research direction
Start by reproducing the failure through the Proxy Provider in proxy mode, using an HTTP/2 website on IIS behind the described NGINX setup. Compare behavior with Authentik 2026.8 and the previous version, and inspect the proxy provider and bound outpost entry points with request logs. Done means the proxied HTTP/2 site loads without IIS returning HTTP 400.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, python
- Domain
- backend, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 42/100