From bc3e28d5abae285b66ef7258a6f1d4143c9f49da Mon Sep 17 00:00:00 2001
From: fuomag9 <1580624+fuomag9@users.noreply.github.com>
Date: Wed, 19 Nov 2025 17:57:14 +0100
Subject: [PATCH] fix callback on protected paths

---
 src/lib/caddy.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/lib/caddy.ts b/src/lib/caddy.ts
index 35a87fe7..90b183a3 100644
--- a/src/lib/caddy.ts
+++ b/src/lib/caddy.ts
@@ -527,13 +527,19 @@ function buildProxyRoutes(
         }
 
         // Create a catch-all route for non-protected paths (without forward auth)
+        // Explicitly exclude the outpost path to prevent interference with callback handling
         const unprotectedHandlers: Record<string, unknown>[] = [...handlers];
         unprotectedHandlers.push(reverseProxyHandler);
 
         hostRoutes.push({
           match: [
             {
-              host: domains
+              host: domains,
+              not: [
+                {
+                  path: [`/${authentik.outpostDomain}/*`]
+                }
+              ]
             }
           ],
           handle: unprotectedHandlers,