I’m using TinyAuth for forwardauth but the service I’m trying to use consistently is saying the headers are not set (and I can verify, they’re not there.)

Traefik: in static config

entryPoints:
  web:
    address: ':80'
    transport:
      respondingTimeouts:
        readTimeout: 600s
        idleTimeout: 600s
        writeTimeout: 600s
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ':443'
    http:
      tls:
        certResolver: letsencrypt
        domains:
          - main: domain.tld
            sans:
              - '*.domain.tld'
    forwardedHeaders:
      trustedIPs:
        - [TinyAuth IP]

in dynamic config:

   tinyauth-auth:
     forwardAuth:
       address: "http://[TinyAuth IP]:3000/api/auth/traefik"
       trustForwardHeader: true
       authResponseHeaders:
         - Remote-User
         - Remote-Groups
         - Remote-Name
         - Remote-Email

This is set as a middleware in the app I’m trying to use.

in tinyauth:

TINYAUTH_APPURL=https://tinyapp.domain.tld/
TINYAUTH_AUTH_TRUSTEDPROXIES=[Traefik IP]
TINYAUTH_APPS_APP_CONFIG_DOMAIN='app.domain.tld'
TINYAUTH_APPS_APP_RESPONSE_HEADERS='Remote-User,Remote-Email,Remote-Group,Remote-Name,X-Remote-Name,X-Remote-User,X-Remote-Group,X-Remote-Email,Forwarded-Host,Forwarded-URI'

(I kept adding response headers hoping something would change)

PocketID is set as an OAuth provider and seems to be working fine, but I can provide further detail if needed.

Curiously, I tried changing the address in the traefik config to “https://tinyauth.domain.tld/” and the headers came through properly, but the redirect went to https://tinyauth.domain.tld/api/auth/traefik.

I think this is actually my issue but they never posted their solution.