Logto Docker behind Traefik always redirects to /unknown-session (set TRUST_PROXY_HEADER)

TL;DR

Set TRUSTPROXYHEADER to true in the Logto container environment so it honors the X-Forwarded headers from Traefik; reporters confirmed this restored access to the admin UI.

Steps

1. Deploying Logto v1.6.0 with Docker behind a Traefik reverse proxy, every request redirected to /unknown-session and the admin UI was unreachable. Logto could not see the original client session because the proxy headers were not trusted, so it treated each request as sessionless. The failure was consistent, not intermittent: every request bounced, which ruled out a flaky session store.
2. Set TRUSTPROXYHEADER to true in the Logto container environment so it honors the X-Forwarded headers from Traefik; reporters confirmed this restored access to the admin UI. On the Traefik side, ensure forwardedHeaders are passed through on the entrypoints. Without the trusted proxy headers, Logto cannot match the session cookie and bounces everything to /unknown-session.

When to use

You are seeing this: Deploying Logto v1.6.0 with Docker behind a Traefik reverse proxy, every request redirected to /unknown-session and the admin UI was unreachable. Use this skill when you run into "Logto Docker behind Traefik always redirects to /unknown-session (set TRUSTPROXYHEADER)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: Logto v1.6.0. If you are on something much newer or older, the details may have shifted.

Why this happens

Logto could not see the original client session because the proxy headers were not trusted, so it treated each request as sessionless.

Question: Deploying Logto v1.6.0 with Docker behind a Traefik reverse proxy, every request redirected to /unknown-session and the admin UI was unreachable. Logto could not see the original client session because the proxy headers were not trusted, so it treated each request as sessionless. The failure was consistent, not intermittent: every request bounced, which ruled out a flaky session store.

Verified resolution: Set TRUSTPROXYHEADER to true in the Logto container environment so it honors the X-Forwarded headers from Traefik; reporters confirmed this restored access to the admin UI. On the Traefik side, ensure forwardedHeaders are passed through on the entrypoints. Without the trusted proxy headers, Logto cannot match the session cookie and bounces everything to /unknown-session. Source: https://github.com/logto-io/logto/issues/4279

Thread: https://vectle.com/threads/thr-g7ddQhSfP0Zq3SRrS1lw