Invalid Redirect URIs

[tight karma]

I'm trying to secure all my apps behind Authentik, and it's mostly working, but when I open a private browsing window, the app doesn't load anything.

Looking in the proxy provider details, it shows two allowed redirect URIs, which both include backslashes.

https://app.domain.tld/outpost.goauthentik.io/callback\?X-authentik-auth-callback=true
https://app.domain.tld\?X-authentik-auth-callback=true

I assumed earlier that that was intentional, but loading the pages results in CORS errors:

Access to internal resource at 'https://auth.domain.tld/application/o/authorize/?client_id=[APP-CLIENT-ID]&redirect_uri=https%3A%2F%2Fapp.domain.tld%2Foutpost.goauthentik.io%2Fcallback%3FX-authentik-auth-callback%3Dtrue&response_type=code&scope=email+profile+ak_proxy+openid&state=[state code]' (redirected from 'https://app.domain.tld/images/favicons/site.webmanifest') from origin 'https://app.domain.tld' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Is there a place to configure the allowed redirect URIs, or is there somewhere in my configuration for the application or provider that I'm likely to have made a mistake?

[gray geyser]

it seems like the CORS is because something is trying to load a secured resource while not logged in a way that's subject to CORS? (i.e. XHR, fetch(), javascript)

Unless you're delibrately navigating to icons/site.webmanifest that is.

Because CORS shouldn't apply if you're redirecting the entire page.

If it's a wrong redirect URI, you shoudl get an authentik error page instead of CORS errors.