guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy #596

Open
Open
guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy#596
Labels
bugSomething isn't working

Description

@rrozza-apolitical
rrozza-apolitical
opened on Apr 2, 2026

Preflight checklist

Ory Network Project

https://busy-mayer-9wpd865lft.projects.oryapis.com

Describe the bug

Hi,

We're integrating Ory Network with a Next.js 16 app using @ory/nextjs@1.0.0-rc.1 and @ory/elements-react@1.1.0. Our app runs in Kubernetes behind Traefik Proxy (not Vercel).

The problem: When NODE_ENV=production, all Ory auth flows (login, registration, recovery, verification) break. The browser is redirected to the raw NEXT_PUBLIC_ORY_SDK_URL (our Ory Network custom domain) instead of going through the app's middleware proxy. This results in 404s server-side and CORS errors client-side.

AI root cause findings:guessPotentiallyProxiedOrySdkUrl in @ory/nextjs short-circuits when isProduction() returns true — it returns orySdkUrl() immediately, before ever checking the knownProxiedUrl option. This means the host-header-derived URL (which the flow functions correctly pass as knownProxiedUrl: await getPublicUrl()) is never used in production. The only non-Vercel production path assumes the SDK URL should be used directly, which doesn't work when the app sits behind a reverse proxy that needs to proxy Ory API calls.

Notably, the middleware's proxyRequest function works correctly — it derives selfUrl from request headers. The issue is isolated to the server-side flow functions (getLoginFlow, etc.) and client-side @ory/elements-react components, which both rely on guessPotentiallyProxiedOrySdkUrl.

Current workaround: Setting NEXT_PUBLIC_NODE_ENV=development to trick isProduction() into returning false, which allows the knownProxiedUrl / window.location.origin code paths to execute. This works but is semantically incorrect and fragile.

Our ask: Is there a supported way to run @ory/nextjs in production behind a non-Vercel reverse proxy (e.g. Traefik, Nginx, HAProxy)?

Environment:
@ory/nextjs@1.0.0-rc.1, @ory/elements-react@1.1.0
Next.js 16 (standalone output, App Router)
Docker Compose + Traefik Proxy
NEXT_PUBLIC_ORY_SDK_URL points to our Ory Network custom domain

Screen.Recording.2026-04-02.at.17.16.29.mov

Thanks for any guidance.

Reproducing the bug

See the video attached above

Relevant log output

Relevant configuration
Version
@ory/nextjs@1.0.0-rc.1 @ory/elements-react@1.1.0
On which operating system are you observing this issue?
None
In which environment are you deploying?
None
Additional Context
No response
Metadata
Metadata
Assignees
No one assigned
    Labels
    bugSomething isn't working
    Type
    No type
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Add copy buttons to all 
       blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

      Skip to content
      guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy #596
      Open
      Open
      guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy#596
      Labels
      bugSomething isn't working
      Description
      @rrozza-apolitical
      rrozza-apolitical
      opened on Apr 2, 2026
      Preflight checklist
      Ory Network Project
      https://busy-mayer-9wpd865lft.projects.oryapis.com
      Describe the bug
      Hi,
      We're integrating Ory Network with a Next.js 16 app using @ory/nextjs@1.0.0-rc.1 and @ory/elements-react@1.1.0. Our app runs in Kubernetes behind Traefik Proxy (not Vercel).
      The problem: When NODE_ENV=production, all Ory auth flows (login, registration, recovery, verification) break. The browser is redirected to the raw NEXT_PUBLIC_ORY_SDK_URL (our Ory Network custom domain) instead of going through the app's middleware proxy. This results in 404s server-side and CORS errors client-side.
      AI root cause findings:guessPotentiallyProxiedOrySdkUrl in @ory/nextjs short-circuits when isProduction() returns true — it returns orySdkUrl() immediately, before ever checking the knownProxiedUrl option. This means the host-header-derived URL (which the flow functions correctly pass as knownProxiedUrl: await getPublicUrl()) is never used in production. The only non-Vercel production path assumes the SDK URL should be used directly, which doesn't work when the app sits behind a reverse proxy that needs to proxy Ory API calls.
      Notably, the middleware's proxyRequest function works correctly — it derives selfUrl from request headers. The issue is isolated to the server-side flow functions (getLoginFlow, etc.) and client-side @ory/elements-react components, which both rely on guessPotentiallyProxiedOrySdkUrl.
      Current workaround: Setting NEXT_PUBLIC_NODE_ENV=development to trick isProduction() into returning false, which allows the knownProxiedUrl / window.location.origin code paths to execute. This works but is semantically incorrect and fragile.
      Our ask: Is there a supported way to run @ory/nextjs in production behind a non-Vercel reverse proxy (e.g. Traefik, Nginx, HAProxy)?
      Environment:
      @ory/nextjs@1.0.0-rc.1, @ory/elements-react@1.1.0
      
Next.js 16 (standalone output, App Router)
      
Docker Compose + Traefik Proxy
      NEXT_PUBLIC_ORY_SDK_URL points to our Ory Network custom domain
      Screen.Recording.2026-04-02.at.17.16.29.mov
      Thanks for any guidance.
      Reproducing the bug
      See the video attached above
      Relevant log output
      Relevant configuration
      Version
      @ory/nextjs@1.0.0-rc.1 @ory/elements-react@1.1.0
      On which operating system are you observing this issue?
      None
      In which environment are you deploying?
      None
      Additional Context
      No response
      Metadata
      Metadata
      Assignees
      No one assigned
        Labels
        bugSomething isn't working
        Type
        No type
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

          Skip to content
          guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy #596
          Open
          Open
          guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy#596
          Labels
          bugSomething isn't working
          Description
          @rrozza-apolitical
          rrozza-apolitical
          opened on Apr 2, 2026
          Preflight checklist
          Ory Network Project
          https://busy-mayer-9wpd865lft.projects.oryapis.com
          Describe the bug
          Hi,
          We're integrating Ory Network with a Next.js 16 app using @ory/nextjs@1.0.0-rc.1 and @ory/elements-react@1.1.0. Our app runs in Kubernetes behind Traefik Proxy (not Vercel).
          The problem: When NODE_ENV=production, all Ory auth flows (login, registration, recovery, verification) break. The browser is redirected to the raw NEXT_PUBLIC_ORY_SDK_URL (our Ory Network custom domain) instead of going through the app's middleware proxy. This results in 404s server-side and CORS errors client-side.
          AI root cause findings:guessPotentiallyProxiedOrySdkUrl in @ory/nextjs short-circuits when isProduction() returns true — it returns orySdkUrl() immediately, before ever checking the knownProxiedUrl option. This means the host-header-derived URL (which the flow functions correctly pass as knownProxiedUrl: await getPublicUrl()) is never used in production. The only non-Vercel production path assumes the SDK URL should be used directly, which doesn't work when the app sits behind a reverse proxy that needs to proxy Ory API calls.
          Notably, the middleware's proxyRequest function works correctly — it derives selfUrl from request headers. The issue is isolated to the server-side flow functions (getLoginFlow, etc.) and client-side @ory/elements-react components, which both rely on guessPotentiallyProxiedOrySdkUrl.
          Current workaround: Setting NEXT_PUBLIC_NODE_ENV=development to trick isProduction() into returning false, which allows the knownProxiedUrl / window.location.origin code paths to execute. This works but is semantically incorrect and fragile.
          Our ask: Is there a supported way to run @ory/nextjs in production behind a non-Vercel reverse proxy (e.g. Traefik, Nginx, HAProxy)?
          Environment:
          @ory/nextjs@1.0.0-rc.1, @ory/elements-react@1.1.0
          
Next.js 16 (standalone output, App Router)
          
Docker Compose + Traefik Proxy
          NEXT_PUBLIC_ORY_SDK_URL points to our Ory Network custom domain
          Screen.Recording.2026-04-02.at.17.16.29.mov
          Thanks for any guidance.
          Reproducing the bug
          See the video attached above
          Relevant log output
          Relevant configuration
          Version
          @ory/nextjs@1.0.0-rc.1 @ory/elements-react@1.1.0
          On which operating system are you observing this issue?
          None
          In which environment are you deploying?
          None
          Additional Context
          No response
          Metadata
          Metadata
          Assignees
          No one assigned
            Labels
            bugSomething isn't working
            Type
            No type
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy #596
              Open
              Open
              guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy#596
              Labels
              bugSomething isn't working
              Description
              @rrozza-apolitical
              rrozza-apolitical
              opened on Apr 2, 2026
              Preflight checklist
              Ory Network Project
              https://busy-mayer-9wpd865lft.projects.oryapis.com
              Describe the bug
              Hi,
              We're integrating Ory Network with a Next.js 16 app using @ory/nextjs@1.0.0-rc.1 and @ory/elements-react@1.1.0. Our app runs in Kubernetes behind Traefik Proxy (not Vercel).
              The problem: When NODE_ENV=production, all Ory auth flows (login, registration, recovery, verification) break. The browser is redirected to the raw NEXT_PUBLIC_ORY_SDK_URL (our Ory Network custom domain) instead of going through the app's middleware proxy. This results in 404s server-side and CORS errors client-side.
              AI root cause findings:guessPotentiallyProxiedOrySdkUrl in @ory/nextjs short-circuits when isProduction() returns true — it returns orySdkUrl() immediately, before ever checking the knownProxiedUrl option. This means the host-header-derived URL (which the flow functions correctly pass as knownProxiedUrl: await getPublicUrl()) is never used in production. The only non-Vercel production path assumes the SDK URL should be used directly, which doesn't work when the app sits behind a reverse proxy that needs to proxy Ory API calls.
              Notably, the middleware's proxyRequest function works correctly — it derives selfUrl from request headers. The issue is isolated to the server-side flow functions (getLoginFlow, etc.) and client-side @ory/elements-react components, which both rely on guessPotentiallyProxiedOrySdkUrl.
              Current workaround: Setting NEXT_PUBLIC_NODE_ENV=development to trick isProduction() into returning false, which allows the knownProxiedUrl / window.location.origin code paths to execute. This works but is semantically incorrect and fragile.
              Our ask: Is there a supported way to run @ory/nextjs in production behind a non-Vercel reverse proxy (e.g. Traefik, Nginx, HAProxy)?
              Environment:
              @ory/nextjs@1.0.0-rc.1, @ory/elements-react@1.1.0
              
Next.js 16 (standalone output, App Router)
              
Docker Compose + Traefik Proxy
              NEXT_PUBLIC_ORY_SDK_URL points to our Ory Network custom domain
              Screen.Recording.2026-04-02.at.17.16.29.mov
              Thanks for any guidance.
              Reproducing the bug
              See the video attached above
              Relevant log output
              Relevant configuration
              Version
              @ory/nextjs@1.0.0-rc.1 @ory/elements-react@1.1.0
              On which operating system are you observing this issue?
              None
              In which environment are you deploying?
              None
              Additional Context
              No response
              Metadata
              Metadata
              Assignees
              No one assigned
                Labels
                bugSomething isn't working
                Type
                No type
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions
                  
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

                  Skip to content
                  guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy #596
                  Open
                  Open
                  guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy#596
                  Labels
                  bugSomething isn't working
                  Description
                  @rrozza-apolitical
                  rrozza-apolitical
                  opened on Apr 2, 2026
                  Preflight checklist
                  Ory Network Project
                  https://busy-mayer-9wpd865lft.projects.oryapis.com
                  Describe the bug
                  Hi,
                  We're integrating Ory Network with a Next.js 16 app using @ory/nextjs@1.0.0-rc.1 and @ory/elements-react@1.1.0. Our app runs in Kubernetes behind Traefik Proxy (not Vercel).
                  The problem: When NODE_ENV=production, all Ory auth flows (login, registration, recovery, verification) break. The browser is redirected to the raw NEXT_PUBLIC_ORY_SDK_URL (our Ory Network custom domain) instead of going through the app's middleware proxy. This results in 404s server-side and CORS errors client-side.
                  AI root cause findings:guessPotentiallyProxiedOrySdkUrl in @ory/nextjs short-circuits when isProduction() returns true — it returns orySdkUrl() immediately, before ever checking the knownProxiedUrl option. This means the host-header-derived URL (which the flow functions correctly pass as knownProxiedUrl: await getPublicUrl()) is never used in production. The only non-Vercel production path assumes the SDK URL should be used directly, which doesn't work when the app sits behind a reverse proxy that needs to proxy Ory API calls.
                  Notably, the middleware's proxyRequest function works correctly — it derives selfUrl from request headers. The issue is isolated to the server-side flow functions (getLoginFlow, etc.) and client-side @ory/elements-react components, which both rely on guessPotentiallyProxiedOrySdkUrl.
                  Current workaround: Setting NEXT_PUBLIC_NODE_ENV=development to trick isProduction() into returning false, which allows the knownProxiedUrl / window.location.origin code paths to execute. This works but is semantically incorrect and fragile.
                  Our ask: Is there a supported way to run @ory/nextjs in production behind a non-Vercel reverse proxy (e.g. Traefik, Nginx, HAProxy)?
                  Environment:
                  @ory/nextjs@1.0.0-rc.1, @ory/elements-react@1.1.0
                  
Next.js 16 (standalone output, App Router)
                  
Docker Compose + Traefik Proxy
                  NEXT_PUBLIC_ORY_SDK_URL points to our Ory Network custom domain
                  Screen.Recording.2026-04-02.at.17.16.29.mov
                  Thanks for any guidance.
                  Reproducing the bug
                  See the video attached above
                  Relevant log output
                  Relevant configuration
                  Version
                  @ory/nextjs@1.0.0-rc.1 @ory/elements-react@1.1.0
                  On which operating system are you observing this issue?
                  None
                  In which environment are you deploying?
                  None
                  Additional Context
                  No response
                  Metadata
                  Metadata
                  Assignees
                  No one assigned
                    Labels
                    bugSomething isn't working
                    Type
                    No type
                    Projects
                    No projects
                      Milestone
                      No milestone
                      Relationships
                      None yet
                      Development
                      No branches or pull requests
                      Issue actions
                      
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

                      Skip to content
                      guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy #596
                      Open
                      Open
                      guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy#596
                      Labels
                      bugSomething isn't working
                      Description
                      @rrozza-apolitical
                      rrozza-apolitical
                      opened on Apr 2, 2026
                      Preflight checklist
                      Ory Network Project
                      https://busy-mayer-9wpd865lft.projects.oryapis.com
                      Describe the bug
                      Hi,
                      We're integrating Ory Network with a Next.js 16 app using @ory/nextjs@1.0.0-rc.1 and @ory/elements-react@1.1.0. Our app runs in Kubernetes behind Traefik Proxy (not Vercel).
                      The problem: When NODE_ENV=production, all Ory auth flows (login, registration, recovery, verification) break. The browser is redirected to the raw NEXT_PUBLIC_ORY_SDK_URL (our Ory Network custom domain) instead of going through the app's middleware proxy. This results in 404s server-side and CORS errors client-side.
                      AI root cause findings:guessPotentiallyProxiedOrySdkUrl in @ory/nextjs short-circuits when isProduction() returns true — it returns orySdkUrl() immediately, before ever checking the knownProxiedUrl option. This means the host-header-derived URL (which the flow functions correctly pass as knownProxiedUrl: await getPublicUrl()) is never used in production. The only non-Vercel production path assumes the SDK URL should be used directly, which doesn't work when the app sits behind a reverse proxy that needs to proxy Ory API calls.
                      Notably, the middleware's proxyRequest function works correctly — it derives selfUrl from request headers. The issue is isolated to the server-side flow functions (getLoginFlow, etc.) and client-side @ory/elements-react components, which both rely on guessPotentiallyProxiedOrySdkUrl.
                      Current workaround: Setting NEXT_PUBLIC_NODE_ENV=development to trick isProduction() into returning false, which allows the knownProxiedUrl / window.location.origin code paths to execute. This works but is semantically incorrect and fragile.
                      Our ask: Is there a supported way to run @ory/nextjs in production behind a non-Vercel reverse proxy (e.g. Traefik, Nginx, HAProxy)?
                      Environment:
                      @ory/nextjs@1.0.0-rc.1, @ory/elements-react@1.1.0
                      
Next.js 16 (standalone output, App Router)
                      
Docker Compose + Traefik Proxy
                      NEXT_PUBLIC_ORY_SDK_URL points to our Ory Network custom domain
                      Screen.Recording.2026-04-02.at.17.16.29.mov
                      Thanks for any guidance.
                      Reproducing the bug
                      See the video attached above
                      Relevant log output
                      Relevant configuration
                      Version
                      @ory/nextjs@1.0.0-rc.1 @ory/elements-react@1.1.0
                      On which operating system are you observing this issue?
                      None
                      In which environment are you deploying?
                      None
                      Additional Context
                      No response
                      Metadata
                      Metadata
                      Assignees
                      No one assigned
                        Labels
                        bugSomething isn't working
                        Type
                        No type
                        Projects
                        No projects
                          Milestone
                          No milestone
                          Relationships
                          None yet
                          Development
                          No branches or pull requests
                          Issue actions
                          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

                          Skip to content
                          guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy #596
                          Open
                          Open
                          guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy#596
                          Labels
                          bugSomething isn't working
                          Description
                          @rrozza-apolitical
                          rrozza-apolitical
                          opened on Apr 2, 2026
                          Preflight checklist
                          Ory Network Project
                          https://busy-mayer-9wpd865lft.projects.oryapis.com
                          Describe the bug
                          Hi,
                          We're integrating Ory Network with a Next.js 16 app using @ory/nextjs@1.0.0-rc.1 and @ory/elements-react@1.1.0. Our app runs in Kubernetes behind Traefik Proxy (not Vercel).
                          The problem: When NODE_ENV=production, all Ory auth flows (login, registration, recovery, verification) break. The browser is redirected to the raw NEXT_PUBLIC_ORY_SDK_URL (our Ory Network custom domain) instead of going through the app's middleware proxy. This results in 404s server-side and CORS errors client-side.
                          AI root cause findings:guessPotentiallyProxiedOrySdkUrl in @ory/nextjs short-circuits when isProduction() returns true — it returns orySdkUrl() immediately, before ever checking the knownProxiedUrl option. This means the host-header-derived URL (which the flow functions correctly pass as knownProxiedUrl: await getPublicUrl()) is never used in production. The only non-Vercel production path assumes the SDK URL should be used directly, which doesn't work when the app sits behind a reverse proxy that needs to proxy Ory API calls.
                          Notably, the middleware's proxyRequest function works correctly — it derives selfUrl from request headers. The issue is isolated to the server-side flow functions (getLoginFlow, etc.) and client-side @ory/elements-react components, which both rely on guessPotentiallyProxiedOrySdkUrl.
                          Current workaround: Setting NEXT_PUBLIC_NODE_ENV=development to trick isProduction() into returning false, which allows the knownProxiedUrl / window.location.origin code paths to execute. This works but is semantically incorrect and fragile.
                          Our ask: Is there a supported way to run @ory/nextjs in production behind a non-Vercel reverse proxy (e.g. Traefik, Nginx, HAProxy)?
                          Environment:
                          @ory/nextjs@1.0.0-rc.1, @ory/elements-react@1.1.0
                          
Next.js 16 (standalone output, App Router)
                          
Docker Compose + Traefik Proxy
                          NEXT_PUBLIC_ORY_SDK_URL points to our Ory Network custom domain
                          Screen.Recording.2026-04-02.at.17.16.29.mov
                          Thanks for any guidance.
                          Reproducing the bug
                          See the video attached above
                          Relevant log output
                          Relevant configuration
                          Version
                          @ory/nextjs@1.0.0-rc.1 @ory/elements-react@1.1.0
                          On which operating system are you observing this issue?
                          None
                          In which environment are you deploying?
                          None
                          Additional Context
                          No response
                          Metadata
                          Metadata
                          Assignees
                          No one assigned
                            Labels
                            bugSomething isn't working
                            Type
                            No type
                            Projects
                            No projects
                              Milestone
                              No milestone
                              Relationships
                              None yet
                              Development
                              No branches or pull requests
                              Issue actions
                              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                              Skip to content
                              guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy #596
                              Open
                              Open
                              guessPotentiallyProxiedOrySdkUrl breaks flows in production behind a non-Vercel reverse proxy#596
                              Labels
                              bugSomething isn't working
                              Description
                              @rrozza-apolitical
                              rrozza-apolitical
                              opened on Apr 2, 2026
                              Preflight checklist
                              Ory Network Project
                              https://busy-mayer-9wpd865lft.projects.oryapis.com
                              Describe the bug
                              Hi,
                              We're integrating Ory Network with a Next.js 16 app using @ory/nextjs@1.0.0-rc.1 and @ory/elements-react@1.1.0. Our app runs in Kubernetes behind Traefik Proxy (not Vercel).
                              The problem: When NODE_ENV=production, all Ory auth flows (login, registration, recovery, verification) break. The browser is redirected to the raw NEXT_PUBLIC_ORY_SDK_URL (our Ory Network custom domain) instead of going through the app's middleware proxy. This results in 404s server-side and CORS errors client-side.
                              AI root cause findings:guessPotentiallyProxiedOrySdkUrl in @ory/nextjs short-circuits when isProduction() returns true — it returns orySdkUrl() immediately, before ever checking the knownProxiedUrl option. This means the host-header-derived URL (which the flow functions correctly pass as knownProxiedUrl: await getPublicUrl()) is never used in production. The only non-Vercel production path assumes the SDK URL should be used directly, which doesn't work when the app sits behind a reverse proxy that needs to proxy Ory API calls.
                              Notably, the middleware's proxyRequest function works correctly — it derives selfUrl from request headers. The issue is isolated to the server-side flow functions (getLoginFlow, etc.) and client-side @ory/elements-react components, which both rely on guessPotentiallyProxiedOrySdkUrl.
                              Current workaround: Setting NEXT_PUBLIC_NODE_ENV=development to trick isProduction() into returning false, which allows the knownProxiedUrl / window.location.origin code paths to execute. This works but is semantically incorrect and fragile.
                              Our ask: Is there a supported way to run @ory/nextjs in production behind a non-Vercel reverse proxy (e.g. Traefik, Nginx, HAProxy)?
                              Environment:
                              @ory/nextjs@1.0.0-rc.1, @ory/elements-react@1.1.0
                              
Next.js 16 (standalone output, App Router)
                              
Docker Compose + Traefik Proxy
                              NEXT_PUBLIC_ORY_SDK_URL points to our Ory Network custom domain
                              Screen.Recording.2026-04-02.at.17.16.29.mov
                              Thanks for any guidance.
                              Reproducing the bug
                              See the video attached above
                              Relevant log output
                              Relevant configuration
                              Version
                              @ory/nextjs@1.0.0-rc.1 @ory/elements-react@1.1.0
                              On which operating system are you observing this issue?
                              None
                              In which environment are you deploying?
                              None
                              Additional Context
                              No response
                              Metadata
                              Metadata
                              Assignees
                              No one assigned
                                Labels
                                bugSomething isn't working
                                Type
                                No type
                                Projects
                                No projects
                                  Milestone
                                  No milestone
                                  Relationships
                                  None yet
                                  Development
                                  No branches or pull requests
                                  Issue actions