providers/proxy: Add a default maxResponseBodySize to Traefik Middleware by wiiaam · Pull Request #21111 · goauthentik/authentik

wiiaam · 2026-03-24T08:32:24Z

Details

In response to CVE-2026-26998, Traefik added a maxResponseBodySize configuration option and is recommending this be set, otherwise a warning will show in the traefik logs.

https://doc.traefik.io/traefik/reference/routing-configuration/http/middlewares/forwardauth/#maxresponsebodysize

Added a default maxResponseBodySize of 4MB to the traefik middleware proxy outpost component. Also fixed an issue where the reconciler would throw an error when trying to run a json patch on a non openapi object.

Checklist

Local tests pass (ak test authentik/)
The code has been formatted (make lint-fix)

If an API change has been made

The API schema has been updated (make gen-build)

If changes to the frontend have been made

The code has been formatted (make web)

If applicable

The documentation has been updated
The documentation has been formatted (make docs)

netlify · 2026-03-24T08:33:28Z

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	`8ee3d42`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-storybook/deploys/69c24c1c7eb98e0008fd4553
😎 Deploy Preview	https://deploy-preview-21111--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2026-03-24T08:34:09Z

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	`8ee3d42`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/69c24c1c8bf58200083ae0d7
😎 Deploy Preview	https://deploy-preview-21111--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu

LGTM

@wiiaam have you checked what happens if someone were to run this but hadn't upgraded their CRDs in their cluster?

codecov · 2026-03-24T12:59:57Z

Codecov Report

❌ Patch coverage is 20.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.76%. Comparing base (1236b23) to head (b5d48c9).
⚠️ Report is 49 commits behind head on main.

Files with missing lines	Patch %	Lines
authentik/outposts/controllers/k8s/base.py	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #21111      +/-   ##
==========================================
- Coverage   92.78%   92.76%   -0.03%     
==========================================
  Files        1000     1000              
  Lines       56592    56564      -28     
  Branches      425      425              
==========================================
- Hits        52511    52471      -40     
- Misses       4081     4093      +12

Flag	Coverage Δ
conformance	`37.40% <20.00%> (+<0.01%)`	⬆️
e2e	`42.89% <20.00%> (+0.01%)`	⬆️
integration	`22.18% <20.00%> (-0.04%)`	⬇️
rust	`0.23% <ø> (ø)`
unit	`91.70% <20.00%> (+0.01%)`	⬆️
unit-migrate	`91.80% <20.00%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

wiiaam · 2026-03-24T22:14:53Z

The API server will just prune the field. The only situation where this would cause an error is if field_validation was set to Strict when calling create_namespaced_custom_object, currently this will revert to the Warn default

https://github.com/kubernetes-client/python/blob/master/kubernetes/docs/CustomObjectsApi.md#create_namespaced_custom_object

I'm happy to do a follow up PR to catch these warnings (for all k8s objects) and show it in the task status?

BeryJu · 2026-03-25T13:39:43Z

The API server will just prune the field. The only situation where this would cause an error is if field_validation was set to Strict when calling create_namespaced_custom_object, currently this will revert to the Warn default

https://github.com/kubernetes-client/python/blob/master/kubernetes/docs/CustomObjectsApi.md#create_namespaced_custom_object

I'm happy to do a follow up PR to catch these warnings (for all k8s objects) and show it in the task status?

Fair enough, yeah that would be nice to add if you have resources for that

…are (#21111) * Add default maxResponseBodySize to traefik middleware component * Fix AttributeError when patching custom kubernetes objects * format Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: Jens Langhammer <jens@goauthentik.io>

authentik-automation · 2026-03-25T13:40:37Z

🍒 Cherry-pick to version-2026.2 created: #21140

…are (cherry-pick #21111 to version-2026.2) (#21140) providers/proxy: Add a default maxResponseBodySize to Traefik Middleware (#21111) * Add default maxResponseBodySize to traefik middleware component * Fix AttributeError when patching custom kubernetes objects * format --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io> Co-authored-by: William Howell <wiiam24@gmail.com> Co-authored-by: Jens Langhammer <jens@goauthentik.io>

* main: (42 commits) endpoints/connectors: fix enabled flag not respected (#21144) web: bump vite from 7.3.1 to 8.0.2 in /web (#21109) website/docs: add a single page about our user interface, document Consent stage (#20533) website: bump the build group across 1 directory with 9 updates (#21127) web: bump knip from 5.88.1 to 6.0.5 in /web (#21129) core: bump drf-spectacular from 0.28.0 to 0.29.0 (#19420) packages/client-go: init (#21139) providers/proxy: Add a default maxResponseBodySize to Traefik Middleware (#21111) core: bump library/nginx from `dec7a90` to `7150b3a` in /website (#21137) core: bump gunicorn from 25.1.0 to 25.2.0 (#21134) core: bump github.com/getsentry/sentry-go from 0.43.0 to 0.44.1 (#21122) core: bump astral-sh/uv from 0.11.0 to 0.11.1 in /lifecycle/container (#21135) ci: bump taiki-e/install-action from 2.69.8 to 2.69.9 in /.github/actions/setup (#21136) web/a11y: Modals, Command Palette (Merge branch) (#17812) website/docs: document file picker values (#20994) packages/client-rust: init (#21117) core: bump sentry-sdk from 2.55.0 to 2.56.0 (#21124) events: add helper to log deprecation configuration_warning message (#21115) core: bump djangorestframework from 3.17.0 to 3.17.1 (#21126) core: bump twilio from 9.10.3 to 9.10.4 (#21123) ...

* main: (26 commits) endpoints/connectors: fix enabled flag not respected (#21144) web: bump vite from 7.3.1 to 8.0.2 in /web (#21109) website/docs: add a single page about our user interface, document Consent stage (#20533) website: bump the build group across 1 directory with 9 updates (#21127) web: bump knip from 5.88.1 to 6.0.5 in /web (#21129) core: bump drf-spectacular from 0.28.0 to 0.29.0 (#19420) packages/client-go: init (#21139) providers/proxy: Add a default maxResponseBodySize to Traefik Middleware (#21111) core: bump library/nginx from `dec7a90` to `7150b3a` in /website (#21137) core: bump gunicorn from 25.1.0 to 25.2.0 (#21134) core: bump github.com/getsentry/sentry-go from 0.43.0 to 0.44.1 (#21122) core: bump astral-sh/uv from 0.11.0 to 0.11.1 in /lifecycle/container (#21135) ci: bump taiki-e/install-action from 2.69.8 to 2.69.9 in /.github/actions/setup (#21136) web/a11y: Modals, Command Palette (Merge branch) (#17812) website/docs: document file picker values (#20994) packages/client-rust: init (#21117) core: bump sentry-sdk from 2.55.0 to 2.56.0 (#21124) events: add helper to log deprecation configuration_warning message (#21115) core: bump djangorestframework from 3.17.0 to 3.17.1 (#21126) core: bump twilio from 9.10.3 to 9.10.4 (#21123) ...

wiiaam added 2 commits March 24, 2026 20:32

Add default maxResponseBodySize to traefik middleware component

141616b

Fix AttributeError when patching custom kubernetes objects

8ee3d42

wiiaam requested a review from a team as a code owner March 24, 2026 08:32

format

b5d48c9

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

BeryJu approved these changes Mar 24, 2026

View reviewed changes

BeryJu merged commit d2f3df7 into goauthentik:main Mar 25, 2026
105 of 106 checks passed

BeryJu added area:backend backport/version-2026.2 Add this label to PRs to backport changes to version-2026.2 labels Mar 25, 2026

authentik-automation bot mentioned this pull request Mar 25, 2026

providers/proxy: Add a default maxResponseBodySize to Traefik Middleware (cherry-pick #21111 to version-2026.2) #21140

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

providers/proxy: Add a default maxResponseBodySize to Traefik Middleware#21111

providers/proxy: Add a default maxResponseBodySize to Traefik Middleware#21111
BeryJu merged 3 commits intogoauthentik:mainfrom
wiiaam:traefik-middleware-fixes

wiiaam commented Mar 24, 2026

Uh oh!

netlify bot commented Mar 24, 2026

Uh oh!

netlify bot commented Mar 24, 2026

Uh oh!

BeryJu left a comment

Uh oh!

codecov bot commented Mar 24, 2026 •

edited

Loading

Uh oh!

wiiaam commented Mar 24, 2026

Uh oh!

BeryJu commented Mar 25, 2026

Uh oh!

Uh oh!

authentik-automation bot commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

wiiaam commented Mar 24, 2026

Details

Checklist

Uh oh!

netlify bot commented Mar 24, 2026

✅ Deploy Preview for authentik-storybook ready!

Uh oh!

netlify bot commented Mar 24, 2026

✅ Deploy Preview for authentik-docs ready!

Uh oh!

BeryJu left a comment

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

wiiaam commented Mar 24, 2026

Uh oh!

BeryJu commented Mar 25, 2026

Uh oh!

Uh oh!

authentik-automation bot commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Mar 24, 2026 •

edited

Loading