OIDC token refresh is skipped when Headlamp runs behind a path-based `baseURL`.

Describe the bug

OIDC token refresh is skipped when Headlamp runs behind a path-based baseURL.

With baseURL: /dev/internal/headlamp, Kubernetes API requests use paths such as:

  /dev/internal/headlamp/clusters/main/apis/metrics.k8s.io/v1beta1/pods

After the access token expires, Headlamp returns 401 Unauthorized instead of refreshing the token and updating the authentication cookie.

Expected behavior: Headlamp should recognize the /clusters/ request after removing the configured baseURL, refresh the token, and continue the session.

To Reproduce

Steps to reproduce the bug:

1. Deploy Headlamp in-cluster with baseURL: /dev/internal/headlamp.
2. Configure OIDC authentication with offline_access.
3. Log in through OIDC.
4. Wait for the access token to expire.
5. Open or refresh a cluster page.
6. Observe 401 Unauthorized responses from /dev/internal/headlamp/clusters/....

Environment (please provide info about your environment):

• Installation type: In-Cluster/Helm
• Headlamp Version: 0.45.0
• Other: Azure Entra ID OIDC, Gateway API, path-based routing

Are you able to fix this issue?

No.

Additional Context

The refresh middleware checks whether the raw request path starts with:

strings.HasPrefix(r.URL.String(), "/clusters/")

With baseURL configured, the path starts with /dev/internal/headlamp/clusters/, so refresh is skipped.

Rewriting only /dev/internal/headlamp/clusters/... to /clusters/... at the Gateway works as a temporary workaround, but rewriting the entire prefix breaks the UI because Headlamp serves the UI at / dev/internal/headlamp/.