Base path stripped from request url for /security/acls request, causes 405 response code

Hello,

We have an issue accessing Security Access Control ACLs tab (/security/acl), in redpanda-console interface.
Access to redpanda-console is facilitated through a nginx reverse proxy, having a location where X-Forwarded-Prefix header is set to: /redpanda-console.
In redpanda-console config we use:
server:
setBasePathFromXForwardedPrefix: true

Example of header for a succesful request (http code 200):
Request URL Header: https://app-dev.ing.net/redpanda-console/api/topics
Referer Header: https://app-dev.ing.net/redpanda-console/topics

Example of Request URL Header, for ACLs tab request (http code 405):
Request URL Header: https://app-dev.ing.net/redpanda.api.dataplane.v1.ACLService/ListACLs
Referer Header: https://app-dev.ing.net/redpanda-console/security/acls

As you can see, for /security/acls, the base path prefix is stripped from the request URL.

We are using redpanda-console 3.3.1. This issue is present in 3.2.1 also.

Can you clarify what the cause is, and if you can deliver a fix for this?

Thank you,
Gabriel Patrascu

Reproduce the Security ACLs request behind the nginx reverse proxy with X-Forwarded-Prefix set to /redpanda-console, then compare it with the working topics request. Trace the request entry point and base-path handling; done means the ACL request retains the /redpanda-console prefix and no longer returns 405.