auth_request /internal/authelia/authz;

auth_request_set $user $upstream_http_remote_user;
auth_request_set $groups $upstream_http_remote_groups;
auth_request_set $name $upstream_http_remote_name;
auth_request_set $email $upstream_http_remote_email;

proxy_set_header Remote-User $user;
proxy_set_header Remote-Groups $groups;
proxy_set_header Remote-Name $name;
proxy_set_header Remote-Email $email;

# API clients must receive the original 401 response. Redirecting an XHR/fetch
# request to auth.laikapstak.li turns it into a cross-origin request which the
# browser blocks as CORS and leaves the application waiting for data.