What the user sees
https://secrets.example.com/dashboard
Demo simulation — do not enter real credentials
Redirecting to login...
What's happening (HTTP)
Browser
Caddy
Logto
Entra
OTS
REQUEST Browser → Caddy
GET https://secrets.example.com/dashboard
Cookie: (none)
💡 No session cookie present
INTERNAL Caddy → oauth2-proxy
forward_auth subrequest
💡 Caddy asks auth layer: is this user authenticated?
RESPONSE Caddy → Browser
302 Found
Location: https://logto.example.com/oidc/auth?
client_id=ots-app
&redirect_uri=https://secrets.example.com/oauth2/callback
&response_type=code
&scope=openid profile email
&state=random-csrf-token
💡 Not authenticated → redirect to Logto
Legend
Browser request
Server response
Server-to-server
Internal process