How do proxies impact webapp authentication?

[dem3tre (Mike)]

Hi all,

Hoping someone can provide a little education on how proxies impact the ability for some webapps to share the same session across tabs (firefox, chrome) without re-authenticating.

For example, Sonarr and Radarr work fine when opening a link in a new tab, but if I try the same in Plex or Portainer, I have to re-authenticate. Remove the proxy and I no longer have to re-authenticate new tabs for Plex or Portainer.

I’m not a web developer but am guessing this behavior has to do with how the webapp is handling session data? How does one go about troubleshooting this type of issue?

Below is a snippet of my caddyfile covering portainer:

(options) {
    gzip
    timeouts none
    realip {
        from cloudflare
        from 10.0.0.0/8
        from 172.16.0.0/12
        from 192.168.0.0/16
    }
}

(tls) {
    tls email@example.com {
        protocols tls1.1 tls1.2
        #ca https://acme-staging-v02.api.letsencrypt.org/directory
    }
}

(block_external_at_root) {
    ipfilter / {
        rule allow
        ip 192.168.0.0/16
        ip 172.16.0.0/12
        ip 10.0.0.0/8
    }
}

portainer.example.com {
    import block_external_at_root
    import options
    import tls

    proxy / http://portainer:9000 {
        transparent
        websocket    
        insecure_skip_verify
    }

  	log / /var/logs/sites/app/portainer-access.log {$LOG_LONG}
    errors /var/logs/sites/app/portainer-errors.log
}