When Traefik is acting as reverse proxy with some form of OIDC integration, the expectation is that 401 and 403 statuses are returned before any upstream services are contacted, assuming that all endpoints and resources are protected by some OIDC bouncing mechanism. In this case, seeing 401/403 in Traefik's access logs should mean that OIDC auth was present and valid, and some other issue occurred in the upstream service.
If crowdsec is in use and it's ingesting Traefik's access logs,
bans may be triggered due to LePresidente/http-generic-401-bf or LePresidente/http-generic-403-bf.
To mitigate this, ensure the access logs include OriginStatus and add the YAMLs below to crowdsec
(replace | with / to get the right path).