# "authenticate\_service\_url" and upstream routes with the same URL no longer working in 0.16.1

**URL:** <https://discuss.pomerium.com/t/authenticate-service-url-and-upstream-routes-with-the-same-url-no-longer-working-in-0-16-1/68>\
**Category:** Support\
**Created:** [January 26, 2022, 8:24am UTC](https://discuss.pomerium.com/t/authenticate-service-url-and-upstream-routes-with-the-same-url-no-longer-working-in-0-16-1/68 "2022-01-26T08:24:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![svKr](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@svKr](https://discuss.pomerium.com/u/svKr)\
**Post date:** [January 26, 2022, 8:24am UTC](https://discuss.pomerium.com/t/authenticate-service-url-and-upstream-routes-with-the-same-url-no-longer-working-in-0-16-1/68/1 "2022-01-26T08:24:24Z")

</div>

## What happened?

When updating from 0.15.8 to 0.16.1 today, I noticed using the same DNS / URL for “_authenticate\_service\_url_” and upstream routes is no longer working.  
I’m using pomerium to add authentication to a dockerized app running on the same Server.

## What did you expect to happen?

Before 0.16.1, I’ve been using “[https://appname.mydomain.com/oauth2/callback](https://appname.mydomain.com/oauth2/callback)” as redirect URL in the IDP and “[https://appname.mydomain.com/app](https://appname.mydomain.com/app)” to access the actual app.  
After 0.16.1, I’m getting " _route not found_ " for the route that uses the same url as configured in " _authenticate\_service\_url_ ".

## How’d it happen?

1. Updated from 0.15.8 to 0.16.1
2. Tried to access my upstream app
3. Got 404 Route not found message in Browser

## What’s your environment like?

- Pomerium version 0.16.1
- docker-compose based deployment on a Ubuntu Instanc

## What’s your config.yaml?

```auto
# See detailed configuration settings : https://www.pomerium.io/docs/reference/reference/
# this is the domain the identity provider will callback after a user authenticates

authenticate_service_url: https://appname.mydomain.com
authorize_service_url: http://127.0.0.1:5443

headers:
  Cache-Control: no-cache

# certificate settings: https://www.pomerium.io/docs/reference/certificates.html
# SSL is terminated on Loadbalancer Level
insecure_server: true

# IDP (cognito) settings
idp_provider: oidc
idp_provider_url: https://cognito-idp.region.amazonaws.com/pool
idp_client_id: xxxxxx
idp_client_secret: xxxxxx
idp_scopes: "openid,email"
jwt_claims_headers: "cognito:groups"

signing_key: yyyyyyy
cookie_secret: zzzzzzz

# custom logout url
signout_redirect_url: https://my.signout.url

# https://www.pomerium.io/configuration/#policy
policy:
  - from: https://appname.mydomain.com
    to: my.upstream.url
    allow_websockets: true
    tls_skip_verify: true
    pass_identity_headers: true
    allowed_idp_claims:
      cognito:groups:
        - myGroup

```

## What did you see in the logs?

```logs
# Paste your logs here.
# Be sure to scrub any sensitive values

```

## Additional context

Adding a 2nd DNS record pointing to the same server and using this new URL as “_authenticate\_service\_url_” seems to work fine in a Sandbox i just created.Is there a way to configure the latest version to work with only one DNS record? Just wanted to clarify before initiating DNS changes.

---

<div class="post-metadata">

**Author:** ![alex](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/alex/32/9_2.png) [@alex](https://discuss.pomerium.com/u/alex)\
**Post date:** [January 26, 2022, 8:34pm UTC](https://discuss.pomerium.com/t/authenticate-service-url-and-upstream-routes-with-the-same-url-no-longer-working-in-0-16-1/68/2 "2022-01-26T20:34:46Z")

</div>

Hi @svKr! This is an interesting use case. Normally, the authenticate service is on one subdomain domain (ie `auth.example.com`) and each service is on it’s own separate one (`service.example.com`). You can do this without making a new DNS record for each domain by creating a CNAME record for `*.example.com` that points to the A record for `example.com`.

Alternately, you can use a subdomain space. That is to say, make a CNAME for `*.something.example.com` and set your Pomerium config to use that sub-subdomain space.

The config you were using with a single domain was something that _shouldn’t_ have worked, but did anyway.

---

<div class="post-metadata">

**Author:** ![svKr](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@svKr](https://discuss.pomerium.com/u/svKr)\
**Post date:** [January 27, 2022, 8:29am UTC](https://discuss.pomerium.com/t/authenticate-service-url-and-upstream-routes-with-the-same-url-no-longer-working-in-0-16-1/68/3 "2022-01-27T08:29:55Z")

</div>

Thanks for the quick clarification Alex.  
Will change the records accordingly.