I have a sample config:

    upstream content {
      server 127.0.0.1:4001;
    }

    server {
        listen 4000;

        location /test-auth {
            add_header X-Test "test value";
            return 200;
        }

        location /proxy {
            add_header "X-Test1" "test1";
            auth_request /test-auth;
            auth_request_set $test $upstream_http_x_test;
            auth_request_set $test2 $upstream_status;
            proxy_pass http://content?test=$test&test2=$test2;
            proxy_pass_request_body off;
            add_header X-Test $test;
            add_header X-Test2 $test2;
        }
    }

    server {
        listen 4001;
        add_header X-Test3 "test3";
        return 200 "test response $args";
    }

I want to pass the X-Test header from the auth location to the browser when requesting /proxy. This should be done by the auth_request_set directive by pulling the $upstream_http_x_test variable value. But it's always empty while the header is set in the auth endpoint output. When accessing the /test-auth directly, it's present in the output. But I can't get it' in the /proxy location. Moreover, the $upstream_status should be always present showing the auth request status, but it's also empty. When I do a request to /proxy, I'm getting only these:

X-Test3: test3
X-Test1: test1

test response test=&test2=

But I also need to have X-Test and X-Test2 headers filled by the data from the auth request and corresponding values in the content part.

The /test-auth endpoint is called correctly. If I return 401 in it, requests to /proxy are failing with 401 too.

What I'm doing wrong?