From 108883ddc0eea11092f8785b485cb4f9c84f14b5 Mon Sep 17 00:00:00 2001
From: Sanjeev Lakhwani <lakhwani.sanjeev691@gmail.com>
Date: Tue, 8 Sep 2026 09:51:44 -0400
Subject: [PATCH] Fix 502 on auth callback caused by large Auth.js response
 headers

Auth.js's /api/auth/callback/bento response sets several large
JWE-encrypted cookies at once, exceeding nginx's default proxy
buffer size and causing nginx to drop the response instead of
relaying it to the browser. Wire up proxy_large_headers.conf in
the public location block, same as is already done for Keycloak.
---
 conf/nginx.conf.tpl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/conf/nginx.conf.tpl b/conf/nginx.conf.tpl
index 4b0fe80..4830689 100644
--- a/conf/nginx.conf.tpl
+++ b/conf/nginx.conf.tpl
@@ -170,6 +170,7 @@ http {
         location / {
             # Reverse proxy settings
             include /gateway/conf/proxy.conf;
+            include /gateway/conf/proxy_large_headers.conf;
 
             # Immediate set/re-use means we don't get resolve errors if not up (as opposed to passing as a literal)
             set         $upstream_public http://${BENTO_PUBLIC_CONTAINER_NAME}:${BENTO_PUBLIC_INTERNAL_PORT};