Monitoring Redirects Can Create False Green Probes
A health probe that automatically follows redirects may end on an authentication page and report successful HTTP even though the original service route is wrong.
Authelia
Human SSO and Machine Authentication Should Not Share One Gate
Firmware cannot complete an interactive Authelia login, but bypassing authentication entirely would expose the OTA control plane.
Cookie Domain and SameSite Policy Are Part of Cross-Subdomain SSO
One identity portal can protect many subdomains only if browser cookie scope and request behavior match the intended trust boundary.
Machine APIs Need Machine Credentials, Not Browser Redirects
A firmware client cannot solve an interactive login flow, and treating the redirect as success hides the real authentication failure.
Anonymous Monitoring Probes Do Not Prove a Human Session Is Broken
Synthetic health checks normally have no browser cookie, so anonymous AuthRequest logs can be completely healthy behavior.
Authelia Sessions Needed Durable State, Not Just Longer Cookies
A longer browser cookie does not help if the server forgets the session behind it.
Session Inactivity, Expiration and Remember Me Solve Different Problems
A session can have an idle timeout, a hard lifetime and a trusted-browser persistence policy at the same time.
Why Authelia-to-OpenBao OIDC Is a Separate Phase
Human federation should be added after the secret authority is stable, not mixed into the initial bootstrap trust ceremony.
Authelia Authentication Failures Need Context, Not Panic
A two-factor login system naturally records failed credentials, expired sessions and rejected access, so any single failure is not automatically an attack.
Google Authenticator Is a TOTP Client, Not the Authentication Server
The six-digit code comes from a shared TOTP secret and time step; Google Authenticator is only one compatible client.
Cookie Domain and SameSite Settings Are Part of SSO Architecture
Cross-subdomain authentication only works predictably when cookie scope and redirect boundaries match the domain design.
Cloudflare and Authelia Logs Explain Edge Failures Differently
A public request can fail before reaching Authelia, inside the authentication flow, or after authentication while the upstream application is unavailable.
Redis and PostgreSQL Have Different Jobs in the Authelia Stack
Persistent SSO works better when ephemeral session state and durable identity-provider state are not confused.
Remember-Me Is a Security Policy, Not a Convenience Toggle
Long-lived trusted-browser sessions change the authentication risk model and should be chosen deliberately.
Two-Factor Policy Belongs at the Shared Access Boundary
Putting MFA in front of each application separately creates duplicated policy; Authelia gives the protected subdomains one identity boundary.