refactor: use x-tinyauth-location header in tinyauth auth request

readme-vars.yml

@@ -220,6 +220,7 @@ init_diagram: |
   "swag:latest" <- Base Images
 # changelog
 changelogs:
+  - {date: "19.07.26:", desc: "Use new X-Tinyauth-Location header in Tinyauth locations."}
   - {date: "10.07.26:", desc: "Add support for Let's Encrypt cert profiles. Run certbot twice daily with a random delay."}
   - {date: "19.06.26:", desc: "Add support for mijn.host dns validation."}
   - {date: "01.06.26:", desc: "Remove obsolete old cert check logic."}

root/defaults/nginx/tinyauth-location.conf.sample

@@ -1,11 +1,13 @@
-## Version 2025/12/17 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-location.conf.sample
+## Version 2026/07/19 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-location.conf.sample
 # Make sure that your tinyauth container is in the same user defined bridge network and is named tinyauth
 # Rename /config/nginx/proxy-confs/tinyauth.subdomain.conf.sample to /config/nginx/proxy-confs/tinyauth.subdomain.conf
 
 ## Send a subrequest to tinyauth to verify if the user is authenticated and has permission to access the resource
 auth_request /tinyauth;
-
-## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the portal
+auth_request_set $redirection_url $upstream_http_x_tinyauth_location;
+error_page 401 403 =302 $redirection_url;
+
+## If the subreqest returns 200 pass to the backend, if the subrequest returns 401 redirect to the URL tinyauth returns in the X-Tinyauth-Location header
 error_page 401 = @tinyauth_login;
 
 ## Translate the user information response headers from the auth subrequest into variables

root/defaults/nginx/tinyauth-server.conf.sample

@@ -1,4 +1,4 @@
-## Version 2025/06/08 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-server.conf.sample
+## Version 2026/07/19 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/nginx/tinyauth-server.conf.sample
 # Make sure that your tinyauth container is in the same user defined bridge network and is named tinyauth
 # Rename /config/nginx/proxy-confs/tinyauth.subdomain.conf.sample to /config/nginx/proxy-confs/tinyauth.subdomain.conf
 
@@ -15,21 +15,3 @@ location /tinyauth {
     proxy_set_header x-forwarded-host $http_host;
     proxy_set_header x-forwarded-uri $request_uri;
 }
-
-# virtual location for tinyauth 401 redirects
-location @tinyauth_login {
-    internal;
-
-    ## Set the $target_url variable based on the original request
-    set_escape_uri $target_url $scheme://$http_host$request_uri;
-
-    ## Set the $signin_url variable
-    set $domain $host;
-    if ($host ~* "^[^.]+\.([^.]+\..+)$") {
-        set $domain $1;
-    }
-    set $signin_url https://tinyauth.$domain/login?redirect_uri=$target_url;
-
-    ## Redirect to login
-    return 302 $signin_url;
-}