升级ingress-nginx至v1.12.1后，Github OAuth重定向流程失效

为修复CVE-2025-1974漏洞，将ingress-nginx控制器从v1.8.0升级至v1.12.1后，收到Github外部OAuth提供商返回的401 Unauthorized响应，且原本重定向至/oauth2/start的流程不再执行。当前使用oauth2-proxy v6.18.0，询问是否需要调整该组件的配置。

现有K8s注解 #

ingress_annotations = {
        "nginx.ingress.kubernetes.io/auth-url" : "https://${var.oauth_host}/oauth2/auth"
        "nginx.ingress.kubernetes.io/auth-signin" : "https://${var.oauth_host}/oauth2/start?rd=$scheme%3A%2F%2F$host$escaped_request_uri"
 }

升级前OAuth Pod日志 #

127.0.0.1:49656 - 484ae136891d5dd0b323e2522220dd42 - - [2025/03/21 18:15:04] <host_url> GET - "/oauth2/auth" HTTP/1.1
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 401 13 0.000

127.0.0.1:49664 - 57bc561ce348991c960620b600e0e544 - - [2025/03/21 18:15:04] <host_url> GET -
"/oauth2/start?rd=https%3A%2F%2F.<host_url>%2Ffavicon.ico"
HTTP/1.1 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"
302 390 0.000

升级后OAuth Pod日志 #

127.0.0.1:45056 - 737ce55fc513e6302d076cf324122acc - - [2025/03/27 11:25:32] <host_url> GET - "/oauth2/auth" HTTP/1.1
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 401 13 0.000

127.0.0.1:45062 - 179f78cda2a2ff0a703298993aa0affe - - [2025/03/27 11:25:32] <host_url> GET - "/oauth2/auth" HTTP/1.1
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36" 401 13 0.000

请问是否需要在oauth2-proxy侧进行新的配置？

内容的提问来源于stack exchange，提问作者João Amaro