NGINX Proxy Manager guide is missing proxy_pass_request_body off and Content-Length reset in the /tinyauth auth_request location

[BaptisteWolff]

The Nginx Proxy Manager guide provides this config for the internal auth_request location:

# Tinyauth auth request
location /tinyauth {
 # Mark the location as internal to prevent direct access
 internal;
 
 # Pass request to Tinyauth
 proxy_pass http://tinyauth:3000/api/auth/nginx;
 
 # Pass the request headers
 proxy_set_header x-forwarded-for $remote_addr;
 proxy_set_header x-real-ip $remote_addr;
 proxy_set_header x-forwarded-proto $scheme;
 proxy_set_header x-forwarded-host $http_host;
 proxy_set_header x-forwarded-uri $request_uri;
}

This is missing two directives that Nginx's own auth_request documentation recommends (source):

proxy_pass_request_body off;
proxy_set_header Content-Length "";

Impact: without these, Nginx forwards the original request body (and its Content-Length) to the internal /tinyauth subrequest for every POST/PUT/PATCH request. This causes Nginx to return a bare 500 Internal Server Error for any state-changing request to the protected app. The request never reaches the backend app at all, so nothing shows up in the app's own logs, which makes this very hard to diagnose. Requests without a body (typically GET/DELETE) are unaffected. The bug is triggered by the presence of a body, not by the HTTP method itself.
I hit this behind an app (Maintainerr) where every write operation silently failed with a 500 and no backend logs, traced it to the missing directives, and confirmed they fix it.

Suggested fix, updating the Advanced Configuration snippet:

# Tinyauth auth request
location /tinyauth {
 # Mark the location as internal to prevent direct access
 internal;
 
 # Pass request to Tinyauth
 proxy_pass http://tinyauth:3000/api/auth/nginx;
 
 # Don't forward the request body to the auth subrequest
 proxy_pass_request_body off;
 proxy_set_header Content-Length "";
 
 # Pass the request headers
 proxy_set_header x-forwarded-for $remote_addr;
 proxy_set_header x-real-ip $remote_addr;
 proxy_set_header x-forwarded-proto $scheme;
 proxy_set_header x-forwarded-host $http_host;
 proxy_set_header x-forwarded-uri $request_uri;
}