Forward Auth Works, Then the Browser Gets Stuck in a Login Redirect Loop
Auth gateways need the original request context to decide and redirect correctly.
forward_auth
Do Not Trust a User Identity Header Just Because Caddy Forwarded It
Identity headers are safe only when clients cannot inject equivalent values around the auth boundary.