Intermitent 401 errors for embeded resource

[uoe-pjackson]

Hi,

We have a server with about 40 applications each with their own vhost in Apache. Currently about 10 of these applications are protected using mod_auth_openidc.

Most of the time everything is fine protected pages and all embeded resource load without error however sometimes, some of the embedded resources (ccs, png, svg etc) fail with a 401 error.

For example the first 3 requests of this page request are normal but the 4th request doesn't have the remote user set.

(IP address, username and referrer urls redacted)

10.0.0.219 - username [23/Oct/2025:17:38:39 +0100] "GET /accounts/login/?next=/ HTTP/1.1" 200 2632 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" 616 2945 19362
10.0.0.219 - username [23/Oct/2025:17:38:39 +0100] "GET /static/edgel/js/edgel.bundle.min.js?dp=2.0.2 HTTP/1.1" 200 148919 "https://example.com/accounts/login/?next=/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" 589 149173 622
10.0.0.219 - username [23/Oct/2025:17:38:39 +0100] "GET /static/edgel/media/uoe-logo.png HTTP/1.1" 200 25706 "https://example.com/accounts/login/?next=/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" 644 25922 482
10.0.0.219 - - [23/Oct/2025:17:38:39 +0100] "GET /static/edgel/favicon/apple-touch-icon.png HTTP/1.1" 401 381 "https://example.com/accounts/login/?next=/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0" 576 529 223

This only happens sometimes and is much easier for us to reproduce on our production system that has more traffic going through.

Some information about our environment:

• Rocky Linux 8
• Apache httpd 2.4.37
• mod_auth_openidc 2.4.16.11
• EntraID

This is the Apache vhost config for one of the sites.

<VirtualHost *:80>
  ServerName https://example.com
  ServerAdmin [email protected]

  ## Vhost docroot
  DocumentRoot "/srv/retainpy/retainpy"
  ## Alias declarations for resources outside the DocumentRoot
  Alias /static "/srv/retainpy/static"

  ## Directories, there should at least be a declaration for /srv/retainpy/retainpy

  <Location "/">
    Require valid-user
    AuthType auth-openidc
    # Pass REMOTE_USER to Gunicorn as the X-Remote-User HTTP header
    RewriteEngine On
    RewriteRule .* - [E=PROXY_USER:%{LA-U:REMOTE_USER},NS]
    RequestHeader set X-Remote-User %{PROXY_USER}e
  </Location>

  <Location "/healthcheck">
    Require all granted
    AuthType None
  </Location>

  <Location "/oidc">
    Require valid-user
    AuthType auth-openidc
  </Location>

  ## Logging
  ErrorLog "/var/log/httpd/example.com-80_error.log"
  ServerSignature Off
  CustomLog "/var/log/httpd/example.com-80_access.log" "%a %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O %D"

  ## Request header rules
  ## as per http://httpd.apache.org/docs/2.4/mod/mod_headers.html#requestheader
  RequestHeader set X-FORWARDED-PROTO https
  RequestHeader unset X-Forwarded-Host

  ## Proxy rules
  ProxyRequests Off
  ProxyPreserveHost Off
  ProxyPass /cosign !
  ProxyPassReverse /cosign !
  ProxyPass /cgi-bin !
  ProxyPassReverse /cgi-bin !
  ProxyPass /static !
  ProxyPassReverse /static !
  ProxyPass / http://localhost:8126/
  ProxyPassReverse / http://localhost:8126/
  ## Rewrite rules
  RewriteEngine On

  RewriteRule ^/sso-logout$ https://example.com/oidc/redirect?logout=https://example.com/ [R,L]


  OIDCProviderMetadataURL https://login.microsoftonline.com/XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/v2.0/.well-known/openid-configuration
  OIDCScope "openid profile"
  OIDCRemoteUserClaim preferred_username ^(.*)@(?:test\.)?example\.com
  OIDCClientID XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
  OIDCCryptoPassphrase XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
  OIDCPrivateKeyFiles /etc/pki/tls/private/example.com-selfsigned.key
  OIDCPublicKeyFiles /etc/pki/tls/certs/example.com-selfsigned.crt
  OIDCProviderTokenEndpointAuth private_key_jwt
  OIDCRedirectURI /oidc/redirect
  OIDCOutgoingProxy wwwcache.example.com:3128
  OIDCXForwardedHeaders X-Forwarded-Proto
  OIDCAuthRequestParams domain_hint=example.com
  OIDCSessionInactivityTimeout 3600
  ## Shibboleth
</VirtualHost>

Has anybody else seen this issue? I'm aware we aren't running the latest version so I'm happy to upgrade that but looking though the release notes I couldn't see anything that would obviously relate to this. I will add logs with LogLevel auth_openidc:debug once I'll got them from the server.

Thanks