- Explain why error_page 401 =200 is required (nginx preserves original
status code without the override, causing fetch() to reject the body)
- Explain why {"Result":true} for POST avoids error dialogs
- Explain proxy_set_header placement: must be inside location / block,
not server block (nginx silently drops parent-level headers when
location block sets its own)
- Explain secfetch_allow = "site=same-site": Chromium tracks redirect
initiator through the chain, so the final /?sso&hash= request carries
Sec-Fetch-Site: same-site instead of same-origin
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Authenticates users via a trusted reverse proxy that sets an HTTP header
with the authenticated user's e-mail address (e.g. Authelia, Caddy,
Traefik, Nginx auth_request).
Unlike the existing proxy-auth plugin, no master IMAP user is required.
Users enter their own IMAP password once; it is stored encrypted and
reused for all future logins.
Features:
- Works with any standard IMAP server
- Credentials stored encrypted per-user (APP_SALT + SSO email)
- Session identity tracking via cookie to handle user switches
- Loop-guard cookie prevents redirect loops on failed auto-login
- Additional accounts (e.g. Gmail) continue to work normally
- Configurable header name and redirect URL
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
