AI Gateway: HTTP 302 from POST requests via OpenAI Python client (intercepted before reaching gateway)

Description

When AI clients using the OpenAI Python client (httpx-based) call the Pangolin AI Gateway endpoint, they intermittently receive HTTP 302 redirects. The OpenAI Python client does not follow 302 redirects for POST requests by default, so these 302s surface as API failures.

Critically, the 302 does not appear in Pangolin's aiSessionLog — across 2,667 logged requests, zero had a 302 status code. This strongly suggests the redirect is being intercepted before the request reaches the Pangolin AI Gateway, likely at the Cloudflare edge or Traefik middleware layer.

Affected Clients

• OpenAI Python client (httpx) — does not follow 302 for POST by default
• DBeaver AI Assistant — identical issue reported at dbeaver/dbeaver#41932 (Aug 26, 2026)
• Likely any HTTP client that does not automatically follow redirects on POST requests

Environment

• Pangolin version: 1.22+
• AI Gateway resource configured with a custom OpenAI-compatible provider
• HTTPS endpoint (port 443), Cloudflare DNS configured in DNS-only mode (not proxied through Cloudflare CDN)
• Traefik reverse proxy in front of Pangolin

Steps to Reproduce

1. Configure an AI Gateway resource in Pangolin with an OpenAI-compatible provider
2. Point the OpenAI Python client (openai package) at the gateway endpoint
3. Make API calls intermittently (especially at the start of a worker run)
4. Observe that all 3 retries fail within ~10 seconds, each receiving a 302

Investigation Findings

Evidence	Detail
aiSessionLog	Zero 302 status codes across 2,667 logged requests
Docker / Traefik logs	No 302 entries matching the failed requests
Direct curl	Always returns HTTP 200 — works fine
Transient	302 resolves on its own within minutes
Client behavior	All 3 retries fail with 302 in <10 seconds

Expected Behavior

POST requests to the AI Gateway should be forwarded to the gateway without being intercepted by intermediate layers (Cloudflare edge, Traefik middleware). When a 302 is returned, it should be logged in the aiSessionLog if it originated from Pangolin.

Actual Behavior

An HTTP 302 redirect is returned intermittently. The redirect is not logged in aiSessionLog, suggesting it originates before the request reaches Pangolin. Clients like the OpenAI Python client fail because httpx does not follow 302 redirects for POST requests by default.

Questions for Maintainers

1. Is there a way to configure the AI Gateway (or its Traefik middleware) to avoid returning 302s for API paths? For example, ensuring the auth middleware never issues a redirect for programmatic API requests.
2. Could this be related to Traefik's auth-forward or middleware headers that trigger a Cloudflare challenge page?
3. Would it be possible to log the request at the Traefik layer so we can identify the source of the 302?

Related

• dbeaver/dbeaver#41932 — identical symptom reported on Aug 26, 2026