Hi everyone, @gentle-bird-90474 and I are experiencing an issue with Oauthkeeper that is blocking us from using our unauthenticated/open APIs. We have set our Oauthkeeper rules for our endpoint to have the following authenticators:

authenticators:
    - handler: cookie_session
    - handler: anonymous
    - handler: bearer_token

And whenever we make an unauthenticated request (without a session cookie), however containing ANY other cookie (such as a simple

test=helloWorld

) it returns a 401 and ignores our

anonymous

rule. If we remove all cookies and perform the same request, it works as intended and is handled as an

anonymous

request. Steps to reproduce can be setting these same authenticators rules and simply adding a cookie to the page (

document.cookie = "test=helloWorld";

e.g.). Then calling any endpoint that has those rules will return a 401, even though the

anonymous

handler is there. Could someone have a look? Thank you!

Had a similar issue and split my rules and I think ended up with noop handler on some routes.

Makes sense, I am creating a bug report today and will send it later here in this thread.

Dear Ory team! This is a real blocker for us. If we cannot solve this or (temporarily) work around this issue, we’ll have to consider replacing Ory Cloud with something else.