flowchart TD
A[Login or gate failure] --> B{127.0.0.1:51091 health works?}
B -->|no| C[Container, port, or config failure]
B -->|yes| D{auth.loca.zone returns HTML?}
D -->|no| E[Nginx portal proxy or TLS failure]
D -->|yes| F{Browser loops after login?}
F -->|yes| G[Cookie scope, forwarded headers, or clock]
F -->|no| H{Forest assets missing?}
H -->|yes| I[sub_filter, compression, route, or CSP]
H -->|no| J[Inspect exact protected location and policy]
Redirect loop
symptoms:
app redirects to auth.loca.zone
successful login returns to the app
app immediately redirects to auth.loca.zone again
check in order:
Authelia health endpoint on 127.0.0.1:51091
auth.loca.zone access rule remains bypass
protected vhost includes snippets/authelia-location.conf at server scope
protected location includes snippets/authelia-authrequest.conf
proxy sends the correct Host and X-Forwarded-Proto
browser has an authelia_session cookie eligible for the target host
host and browser clocks are sane
common mistake:
assuming the domain rule alone protects a route
actual gate is the exact Nginx location that invokes auth_request
commands:
use read-only health, state, and log commands in Operator runbook
Cookie domain mistake
required live values:
cookie domain: loca.zone
Authelia URL: https://auth.loca.zone
cookie name: authelia_session
failure patterns:
domain too narrow: protected sibling hosts do not receive the cookie
invalid public-suffix or special-use domain: browser refuses the cookie
wrong scheme or host in authelia_url: return URL or cookie scope fails validation
stale browser cookie after a config change: behavior appears inconsistent
repair order:
correct and validate server configuration first
restart only after approval
then remove the stale cookie in browser storage and sign in again