oauth2-proxy: Unable to find a valid CSRF token. Version 7.4.x (latest)

Expected Behavior

Looking for a 200 response after a successful login

Current Behavior

Getting a 403 response: “Unable to find a valid CSRF token” and in Nginx logs: AuthFailure Invalid authentication via OAuth2: unable to obtain CSRF cookie

Possible Solution

Have read the manual, logs, looked online, tried secure / insecure and all the options in oauth2-proxy, nothing seems to fix it.

Steps to Reproduce (for bugs)

happens every time i try (with below configurations / run command).

Context

Very new with oauth2-proxy,

Your Environment

• Ubuntu 22.04
• Oauth2-Proxy Version used: v7@latest, installed today

Oauth2 Proxy

/root/go/bin/oauth2-proxy
–email-domain=*
–skip-provider-button=true
–cookie-samesite=lax
–cookie-secret=changeme=
–cookie-secure=false
–provider=github
–reverse-proxy=true
–footer=-
–banner=-
–client-id=changeme
–client-secret=changeme
–scope=read
–redirect-url=https://oauth2.example.com/oauth2/callback

Nginx

server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name status.example.com;

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

root /data/web/status.example.com/html;
index index.html index.htm index.php;

location /oauth2/ {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
    # or, if you are handling multiple domains:
    # proxy_set_header X-Auth-Request-Redirect $scheme://$host$request_uri;
}

location /oauth2/auth {
    proxy_pass       http://127.0.0.1:4180;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
}

location / {
    auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --pass-access-token, this will pass the token to the backend
    auth_request_set $token  $upstream_http_x_auth_request_access_token;
    proxy_set_header X-Access-Token $token;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;

    # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb
    # limit and so the OAuth2 Proxy splits these into multiple parts.
    # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,
    # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.
    auth_request_set $auth_cookie_name_upstream_1 $upstream_cookie_auth_cookie_name_1;

    # Extract the Cookie attributes from the first Set-Cookie header and append them
    # to the second part ($upstream_cookie_* variables only contain the raw cookie content)
    if ($auth_cookie ~* "(; .*)") {
        set $auth_cookie_name_0 $auth_cookie;
        set $auth_cookie_name_1 "auth_cookie_name_1=$auth_cookie_name_upstream_1$1";
    }

    # Send both Set-Cookie headers now if there was a second part
    if ($auth_cookie_name_upstream_1) {
        add_header Set-Cookie $auth_cookie_name_0;
        add_header Set-Cookie $auth_cookie_name_1;
    }

    try_files $uri $uri.html $uri/ @extensionless-php;
    # auth_basic           "RMN Members";
    # auth_basic_user_file /data/web/status.rainbowmobilenetworks.com/.htpasswd; 
}

location ~ \.php$ {
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
}

location @extensionless-php {
    rewrite ^(.*)$ $1.php last;
}

location ~ /\.ht {
    deny all;
}    

}