Backstage Proxied Auth Session Loop

In this tutorial, you'll learn about Backstage Proxied Auth Session Loop. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

Users get authentication loops or 401 errors when Backstage is deployed behind a reverse proxy.

Wrong ❌

# app-config.yaml
auth:
  environment: production
  providers:
    auth0:
      production:
        clientId: my-client-id
        clientSecret: ${AUTH_CLIENT_SECRET}
        domain: my-tenant.auth0.com
        # Missing authProxy configuration

Wrong Output

Login redirects in infinite loop:
http://backstage.example.com/api/auth/auth0/handler/frame
-> http://backstage.example.com/api/auth/auth0/refresh
-> http://backstage.example.com/api/auth/auth0/handler/frame

Right ✅

# app-config.yaml
auth:
  environment: production
  providers:
    auth0:
      production:
        clientId: my-client-id
        clientSecret: ${AUTH_CLIENT_SECRET}
        domain: my-tenant.auth0.com
        authProxy:
          enabled: true
          provider: auth0
          headers:
            - name: X-Forwarded-Proto
              value: https
            - name: X-Forwarded-Host
              value: backstage.example.com
            - name: X-Forwarded-For
              value: request

Right Output

Login completes successfully:
Redirect URI matches configured callback
Session cookie set: backstage-session=abc123
User authenticated: user@example.com

Prevention

• Enable authProxy configuration when Backstage is behind any reverse proxy (NGINX, Cloudflare, AWS ALB).
• Set X-Forwarded-Proto to https on the proxy to avoid redirect loops.
• Ensure the backend baseUrl matches the proxy URL exactly.
• Configure session cookies with secure: true and sameSite: 'lax' for HTTPS.
• Test the full OAuth flow locally before deploying to production.

DodaTech applies similar defensive patterns across Doda Browser, DodaZIP, and Durga Antivirus Pro infrastructure for production reliability.

Common Mistakes with proxied auth

1. Forgetting that lazy evaluation defers computation until the value is forced, causing space leaks with unevaluated thunks
2. Using return to exit a function early instead of wrapping a pure value in the monad
3. Mixing let bindings with <- bindings in do notation, producing type errors

These mistakes appear frequently in real-world BACKSTAGE code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

This quick fix is part of the DodaTech infrastructure engineering series. Learn more at DodaTech tutorials.