I'm trying to integrate Github authentication. Authentication for the web UI works perfectly. However, the exclude directive fails to apply to the OFREP and evaluation endpoints when authentication is required.
authentication:
required: true
exclude:
evaluation: true
ofrep: true
session:
domain: flipt.mydomain.com
secure: true
methods:
github:
client_id: ${secret:file:github-auth-client-id}
client_secret: ${secret:file:github-auth-client-secret}
enabled: true
redirect_address: https://flipt.mydomain.com
scopes:
- read:org
allowed_organizations:
- my-organization
{"L":"ERROR","T":"2025-09-19T08:08:45Z","M":"unauthenticated","server":"grpc","reason":"authentication required"}
{"L":"INFO","T":"2025-09-19T08:08:45Z","M":"finished unary call with code Unauthenticated","server":"grpc","grpc.start_time":"2025-09-19T08:08:45Z","system":"grpc","span.kind":"server","grpc.service":"flipt.ofrep.OFREPService","grpc.method":"EvaluateFlag","peer.address":"0","error":"rpc error: code = Unauthenticated desc = request was not authenticated","grpc.code":"Unauthenticated","grpc.time_ms":0.106}
Bug Description
I'm trying to integrate Github authentication. Authentication for the web UI works perfectly. However, the exclude directive fails to apply to the OFREP and evaluation endpoints when authentication is required.
Version Info
v2.1.1
Search
Steps to Reproduce
Run Flipt with the following authentication config:
Expected Behavior
Flipt should skip authentication for the evaluation and OFREP endpoints as per the documentation:
https://docs.flipt.io/v2/configuration/overview#authentication
Additional Context