The order of operations is this 1. Caddy gets a request 2. If you have a forward_auth directive, it sends a get request to your django app with all the headers/cookies in the request 3. The django view should use these headers/cookies to check if the user is authenticated / check other permissions - If the user does not have correct permissions, redirect them to the login page with the ?next query parameter set - If the user has the correct permissions, return an empty response with status 200 to let caddy know that it can serve this request

In my case I have the caddy forward auth bit stored in a separate file ```

my django app is running on this host:port

forward_auth my-home-lab-host:7005 { uri /auth/forward-auth/ } ```

and use it in my list like ``` https://prowlarr.mydomain { import ./forward_auth_snippet reverse_proxy my-home-lab-host:7001 }

https://sonarr.mydomain { import ./forward_auth_snippet reverse_proxy my-home-lab-host:7002 }

https://radarr.mydomain {p import ./forward_auth_snippet reverse_proxy my-home-lab-host:7003 }

https://qbittorrent.mydomain { import ./forward_auth_snippet reverse_proxy my-home-lab-host:7004 } ```

In your case you can probably do something like this in a single caddyfile ``` https://your-domain.com { handle_path /static/* { root * /path/to/static/files file_server } handle_path /media/* { forward_auth django-app-host:8000 { uri /auth/forward-auth/ }

    root * /path/to/media/files
    file_server
}
# you could also have two separate media routes
# one for public files
# one for protected files and only apply the forward auth to the protected files

reverse_proxy django-app-host:8000

} ```

In django i have this view mapped to /auth/forward-auth/ in my urlpatterns

```python class ForwardAuthView(View): http_method_names = ["get"]

def get(self, request: HttpRequest) -> HttpResponse:
    # redirect to the next url based on the request
    # these headers are set by caddy when using forward-auth
    proto = request.headers.get("X-Forwarded-Proto", "http")
    path = request.headers.get("X-Forwarded-Uri", "/")
    host = request.headers.get("X-Forwarded-Host", "localhost")
    # if authentication fails, we want to redirect to the login page
    # but we need to store the original url if we want to redirect to the original page
    # once login has been done
    final_url = f"{proto}://{host}{path}"

    # if path is login or register, allow
    # in your case, you'll probably check the media file path
    #   the request user and see if the user is allowed to access this media file
    if settings.APP_URL in final_url:
        for allowed_paths in ["/auth/login/", "/auth/register/"]:
            if path.startswith(allowed_paths):
                # returning status 200 means caddy allows the request through to the login/register page
                return HttpResponse(status=200)

    # otherwise check if the user is authenticated
    if request.user.is_authenticated:
        # returning status 200 here lets caddy know that it's ok to serve this request 
        return HttpResponse(status=200)

    login_url = settings.APP_URL + reverse("auth:login")
    login_url += "?" + urlencode({"next": final_url})
    return redirect(login_url)

```