Hi all, when upgrading to Oathkeeper v26.2.0 I see weird redirection behavior with session authentication. I have setup the following

errors:
  fallback:
    - redirect
  handlers:
    redirect:
      enabled: true
      config:
        to: <https://blub.bla/login>
        return_to_query_param: return_to

and also configured:

serve:
  proxy:
    port: 4455
    trust_forwarded_headers: true

I am certain my ingress (contour) correctly sets the

X-Forwarded-Proto

header to

https

. But since the upgrade all my redirects are redirecting to

http

Does anyone else face the same issue? Is there a fix? Did I miss a config parameter. Thanks for helping out

from what I can see: there are some changes to decision api https://github.com/ory/oathkeeper/compare/v25.4.0...v26.2.0#diff-59b7425b35718cbaf90468c9bf8a7e2a745f241e407d736c1a50769413059efb but seems to be only cleanup work with replacing internal compare methods with those found in

cmp

. From what I can see, nothing has really changed. Does reverting to previous version fix it? If so, I can dive a bit further. Maybe headers are not getting propagated properly, thus causing default behavior to kick in rather than rely on forwarded headers

Yes, reverting to the previous version fixed it. My suspicion is this commit `Only use X-Forwarded-Proto header when trusted` (e9acca1) is causing the behavior. I just can't understand why, because I have configured

trust_forwarded_headers: true

. Thanks for checking!