traefik-forward-auth rejecting the authentication but no error reported

[rdelcorro]

Hi, I have a traefik fronting my internal services and everything is exposed in the home.ramirodelcorro.com domain. Externally I use X.ramirodelcorro.com which points to a firewall -> HA proxy -> Traefik

I was able to setup traefik-forward-auth, I get the login page but after the login flow, I get redirected back 307 to the login page. I have tried almost all the settings and even using trace logging but the app is not explaining why its not accepting the login. Adding DEFAULT_ACTION=allow env var, resolves the problem (but does not auth at all)

Compose file:

version: '3.7'

## NETWORKS ##
networks:
  traefik_proxy:
    external:
      name: traefik_proxy
  default:
    driver: bridge

## SERVICES ##
services:
  oauth:

    networks:
      traefik_proxy: {}
    hostname: oauth
    image: thomseddon/traefik-forward-auth:2
    restart: unless-stopped
    environment:
      - URL_PATH=/_oauth
      - LOG_FORMAT=pretty
      - WHITELIST=REDACTED
      - PROVIDERS_GOOGLE_CLIENT_ID=REDACTED
      - PROVIDERS_GOOGLE_CLIENT_SECRET=REDACTED
      - SECRET=lkhjaskjeghdkuaga
      - INSECURE_COOKIE=false
      - COOKIE_DOMAIN=home.ramirodelcorro.com
      - AUTH_HOST=https://oauth.home.ramirodelcorro.com
      - LOG_LEVEL=trace

    labels:
      - "traefik.http.middlewares.oauth.forwardauth.authResponseHeaders=X-Forwarded-User"
      - "traefik.http.middlewares.oauth.forwardauth.address=https://oauth.home.ramirodelcorro.com"
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.oauth-rtr.entrypoints=https"
      - "traefik.http.routers.oauth-rtr.rule=Host(`oauth.home.ramirodelcorro.com`)"
      - "traefik.http.routers.oauth-rtr.tls=true"
      - "traefik.http.services.oauth.loadbalancer.server.port=4181"
      ## Health checks
      ## Middlewares
      - "traefik.http.routers.oauth-rtr.middlewares=chain-oauth-local@file"

The service is doing this:

version: '3.7'

## NETWORKS ##
networks:
  traefik_proxy:
    external:
      name: traefik_proxy
  default:
    driver: bridge
    
## SERVICES ##
services:
  whoami:

    networks:
      traefik_proxy: {}
    hostname: whoami
    image: containous/whoami
    restart: unless-stopped

    labels:
      - "traefik.enable=true"
      ## HTTP Routers
      - "traefik.http.routers.whoami-rtr.entrypoints=https"
      - "traefik.http.routers.whoami-rtr.rule=Host(`whoami.home.ramirodelcorro.com`)"
      - "traefik.http.routers.whoami-rtr.tls=true"
      ## Health checks
      ## Middlewares
      - "traefik.http.routers.whoami-rtr.middlewares=oauth@docker"

Logs:

time="2021-03-12T22:18:01Z" level=debug msg="Authenticating request" cookies="[_ga=GA1.2.997799889.1597627684 __cfduid=d59de4686302557fb51112193f9180e6b161418REDACTED _forward_auth_csrf=e112522156de86b165948fb66REDACTED_forward_auth_csrf=1398f9b9c636e89f2bc24d6c4e78REDACTED]" handler=Auth host=oauth.home.ramirodelcorro.com method= proto=https rule=default source_ip=192.168.0.100 uri=
time="2021-03-12T22:18:01Z" level=debug msg="Set CSRF cookie and redirected to provider login url" csrf_cookie="_forward_auth_csrf=ffdc632ae485eb5787c4a3b4a3e6REDACTED; Path=/; Domain=oauth.home.ramirodelcorro.com; Expires=Sat, 13 Mar 2021 10:18:01 GMT; HttpOnly; Secure" handler=Auth host=oauth.home.ramirodelcorro.com login_url="https://accounts.google.com/o/oauth2/auth?client_id=REDACTED91-a3ipdfm8sfl81be9glc24bf1ng5370ss.apps.googleusercontent.com&prompt=select_account&redirect_uri=https%3A%2F%2Foauth.home.ramirodelcorro.com%2F_oauth&response_type=code&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email&state=REDACTEDe485eb5787c4a3b4a3e65b7c%3Agoogle%3Ahttps%3A%2F%2Foauth.home.ramirodelcorro.com" method= proto=https rule=default source_ip=192.168.0.100 uri=

Thanks!